%3F.png)
I have forever been accessing remote machines with things like file shares (\\serverName\share) and using Powershell commands that use a -ComputerName parameter. If I do this for a machine in a remote domain, I have to provide the -Credential argument. And that all works fine. I think that's called DCOM. I can also access WMI like that. However, when I try to use enter-pssession to the remote machine, it does not work because of some kerberos thing. Supposedly, the difference is that kerberos provides mutual authentication of the machines. But, if I am accessing a machine in a remote domain, it is not using kerberos anyway for the DCOM style transactions. So, if I make the pssession work by putting the remote machine into my Winrm TrustedHosts (and naming it with the IP address) instead up setting up a certificate infrastructure (and thus not having any machine authentication) is that really any worse than the DCOM commands I've been running forever? --I've seen people write things like, "only use this on test machines, not a production environment" because the connection is not encrypted. But, the transaction of credentials is supposedly still encrypted. If it is ok to use -ComputerName and -Credential with other commands, what's the difference?
답변1
Yes it is less secure.
NTLM (which is the authentication protocol used) is technically less secure. You are presenting your credentials to a host. And NTLM does not offer authentication of the host to the client. It's straightforward for an attacker to impersonate that host at that IP address.
In a Kerberos environment you do not present your credentials to the host, you present credentials to a separate authentication server, it provides a token, and that token is then presented for authentication. The credentials are presented in fewer hosts that are more secure than a typical server.
If Basic Authentication is enabled and used instead of Negotiate/NTLM, those credentials are sent over the wire unencrypted, which is obviously bad. However after authentication, the session is encrypted at the message level regardless of the HTTP/HTTPS transport scheme. Basic+HTTP and Digest authentication methods should never be enabled/used.
Most organizations don't do this due to it wouldn't pass an audit. In workgroup scenarios, certificates are nearly always used.
https://devblogs.microsoft.com/powershell/compromising-yourself-with-winrms-allowunencrypted-true/