POWERSHELL REMOTING -
OVERVIEW
What is PowerShell Remoting?
1. PowerShell Remoting allows you to connect to a remote computer and run commands virtually
from a host computer.
2. You can remotely connect to multiple computers.
3. The local computer is the computer you are inputting commands on.
4. The remote computer is the target or targets you are remotely connecting to using PowerShell.
Considerations
1. Both computers (local computer) and (target) must have PowerShell remote enabled and the
required permissions to access files on each system.
2. Both computers must have:
a. Windows PowerShell 3.0
b. .NET Framework 4
c. WinRM 3.0
3. The local computer and target must have remote PowerShell enabled by running:
a. Enable-PSRemoting
TYPES OF AUTHENTICATION
Basic Authentication
The most insecure type, built into the HTTP protocol. Sends a base64 encoded copy of username and
password in the HTTP header from the client to the listener. It is insecure because it does not encrypt
the username and password only encodes them.
Kerberos Authentication
Default authentication method for Active Directory. Both the client and server must be joined to the
same Active Directory Forest.
Negotiate Authentication (NTLM)
WinRM (Windows Remote Management) backup authentication if Kerberos fails is NT Lan Manager
(NTLM). NTLM is good for validating the client but unlike Kerberos it does not validate the server. NTLM
is only useable if you add the server to the trusted host list or use an HTTPS listener.
Digest Authentication
One of the more uncommon types of authentications, like NTLM, Digest generates a unique string that is
encrypted with the hash of the user’s password. The password then doesn’t need to be sent to the
server.
Digest uses the MD5 hashing algorithm to encrypt the password.
CredSSP (Credential Security Support Provider)
Authentication
This authentication method is primarily used to solve the “double hop” problem. The double-hop
problem occurs when you connect to a remote computer over PSRemoting and then need to connect to
another remote computer. This is problematic because when the WinRM client authenticates the first
remote computer, the server (active directory) only validates the identity of the client without sending
the password to the server. The second remote computer therefore does not have any way to validate
the user’s identity.
CredSSP can be used to solve this problem by storing user credentials on the first remote computer
which can then be passed to the second remote computer.
Certificate-Based Authentication
One of the most secure methods for authentication, in this method a typical key exchange happens with
a private and public key on the client and a server validating the certificate.
WinRM authenticates the user by mapping the user on the server. The only key that is passed during the
authentication process is the public key.
However, with certificate-based authentication you cannot use a domain user to authenticate with
certificates even if both the client and server are part of Active Directory.