5
1
How safe is it to make the Remote Powershell (aka PSRemoting) endpoint of a production server accessible from the internet?
We're not a bank or anything, but the server does hold sensitive corporate data.
I intend to secure it by:
- Using IP filtering to only accept connections from our own public IP range, so that we can manage it from another part of our network.
- Having the endpoint accept only SSL connections
- Only allowing connections from a limited set of users with a complex password (~150 bits entropy)
- Using a PSSessionConfiguration that has the
LanguageMode
set toNoLanguage
, so that only scripts can be executed - Requiring that all Powershell scripts that are executed this way are signed (
Set-ExecutionPolicy RemoteSigned
)
On the other hand:
- The remote scripts will be executed under a local admin account
- with no restrictions on the Cmdlets/Modules it can invoke.
- I suspect that the WinRM service (that makes PSRemoting possible) is safe enough to be exposed to the internet (Azure VM's have this by default), but I have no evidence of this.
So, I guess my question is: is this 'safe', or are there attack vectors that I'm missing here?
By the way, I have most of my information from the free eBook Secrets of Powershell remoting.
On Server 2012 there is PowerShell Web Access.
– E.V.I.L. – 2015-02-10T05:44:19.223