2

I am looking for specific feedback on WinRM. There are ::still:: debates out there about whether or not making RDP publicly available without a VPN is a good idea--There are no debates on whether or not making SSH publicly available is a good idea, as long as it is setup correctly...

Where does WinRM fit in at this point: Use with a VPN, No VPN, etc?

1
+100

I have used WinRM on some occasions to expose metrics - without using VPNs and such. But there are some security considerations:

  1. Try running winrm get winrm/config to see how things are configured currently.
  2. Make sure WinRM uses has a certificate installed for HTTPS purposes. This has to go into the Personal store on the Local Computer (yes - odd nomenclature)
  3. Enable HTTPS by doing winrm quickconfig -transport:https

Once the transport is secured, you need to enable client certificate authentication and disable everything else:

  1. Disabling stuff is done like this winrm set winrm/config/client/auth @{Digest="false"}.
  2. Disable Kerberos, Digest and whatever else is around.
  3. Enable certificate authentication by doing winrm set winrm/config/client/auth @{Certificate="true"}
  4. I can't quite remember if you need winrm set winrm/config/client/auth '@{CredSSP="true"} for things to work - it may be needed for credentials delegation.

This works well and if you trust the Windows HTTP transport, the Windows PKI infrastructure and you have a firewall in place that lets you filter out obvious nasties, it is an option that works out fine. It is quite nice if you need to collect things programatically.

Now, the other thing is: will you be able to get all the info you want via WinRM? This is not as easy to answer. I find that a number of things are harder to get at than you might think. I want status on RAID controllers and such, but this is difficult at best. Using RDP over SSH (just to be sure) is still my favored way of doing this because of the added versatility you get.

In conclusion, yes - you can use WinRM without VPNs and such, but you should consider if it gets you what you want in the end.

EDIT: Comparing the use of WinRM with SSH is perhaps not entirely useful - at least from a feature package perspective. Using SSH, you can get anything if you are prepared to write something that collects the information you want. WinRM is less versatile in that sense. Securitywise, however, both are fine IMHO if you lock things down properly which is entirely possible.

1

Not a windows guy so i can't speak too much to WinRM specifics.

the bottom line, though, is that any remote-access service like ssh or winrm has risks and benefits. From what I can tell they provide roughly analogous functionality. If they provide similar levels of AAA then you might treat them similarly in your security posture. E.g., if WinRM uses https certificates for authentication, but openssh allows passwords sent over the wire (one possible config), WinRM's AAA is probably better.

Are the privileges of each service limited? E.g., on Linux you might run selinux so that inbound ssh connections can only do certain operations.

You should also consider how much you trust the different vendors/implementations. Do you expect to see remotely exploitable bugs in openssh & *nix more or less than in windows? Trying to word this so as not to be a troll - it's obviously a loaded question. But the issue is very real.

As far as what that security posture specifically should be...some people put ssh out in the open on port 22, some people require a VPN before you can connect. Some use security through obscurity and put ssh on port 222 instead of port 22.

Some have a whitelist of what IPs are allowed to connect. You might do the whitelisting in sshd or in iptables. On windows, in the windows firewall, or possibly in winrm itself? There are lots of possibilities.

  • 1
    Thanks for the comments, but I am looking for specific feedback on WinRM. There are ::still:: debates out there about whether or not making RDP publicly available without a VPN is a good idea--There are no debates on whether or not making SSH publicly available is a good idea, as long as it is setup correctly... Which is why I am looking for feedback on WinRM in particular. – Josh Brower Mar 3 '15 at 19:22
  • I think this comment gets at the gist of your question, perhaps a little better than the way you originally stated it. – Dan Pritts Mar 5 '15 at 22:20
  • I rewrote the question.... Hopefully that will bring some clarity. – Josh Brower Mar 6 '15 at 10:39
0

WinRM is capable of using HTTPS transport, and if your machines are in the domain and have your enterprise certificates on them already, it should Just Work.

  • I understand that it should Just Work...... I am looking for thoughts/guidance from a security perspective--Is WinRM to be treated like SSH, where we have LAMP + SSH publicly available on the Internet? Or is it a service that still needs to be put behind a VPN, etc? – Josh Brower Mar 2 '15 at 12:09
  • Really? Do you put HTTPS behind a VPN? – Michael Hampton Mar 2 '15 at 13:31
  • I am apparently not communicating well.. :) I am asking if people are treating WinRM like SSH in terms of making it publicly available across the Internet for remote access scenarios. – Josh Brower Mar 2 '15 at 15:23

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.