Azure / Azure/aksArc

[BUG] Moc checks for Powershell Remoting are incorrect in assumptions about single-node availability

Open
#211 4 comments 0 reactions 1 assignee Claimed by @madhanrm View on GitHub
Bug
Dominant language
PowerShell
Stars
118
Forks
63
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
When you run `Initialize-AksHciNode` or `Set-AksHciConfig`, the Moc cmdlet has to do some stuff to determine if a node has Powershell Remoting enabled:

The first step is to check and enable Powershell Remoting (**Common.psm1**)...

```
function Enable-Remoting
{
<#
.DESCRIPTION
Enables powershell remoting on the local machine.
#>

Write-Status $($GenericLocMessage.comm_ps_remote) -moduleName $global:MocModule

Enable-PSRemoting -Force -Confirm:$false
winrm quickconfig -q -force
}
```

And then after it needs to test it (**Moc.psm1**)...

```
function Test-Remoting
{
<#
.DESCRIPTION
Validate that powershell remoting to a node is working.

.PARAMETER nodeName
The node to remote to.
#>

param (
[String]$nodeName
)

try
{
Invoke-Command -ComputerName $nodeName -ScriptBlock { return $null } -ErrorAction Stop
return $true
} catch {}

return $false
}
```

The problem is this logic assumes that on a single-node system, you can `Invoke-Command` against yourself without it throwing an error and thus you receive a false-negative. This specifically happens when CredSSP hardening is configured and you are _not_ specifying an FQDN to yourself.

As an example, here are screenshots proving that the "raw" commands to enable remoting work fine on the single-node:

![image](https://user-images.githubusercontent.com/503974/188732528-cf10e5f2-6ca5-495e-8912-df9bba6f7d0d.png)

`Invoke-Command` from a remote server works fine:

![image](https://user-images.githubusercontent.com/503974/188733242-91847e72-e899-4e9a-8e21-f35e8f84b364.png)

But `Invoke-Command` with shortname to itself fails:

![image](https://user-images.githubusercontent.com/503974/188736614-7dca0d38-f694-4070-b89f-4e058b4abde4.png)

And `Invoke-Command` with FQDN to itself succeeds:

![image](https://user-images.githubusercontent.com/503974/188736473-158706da-7d5c-42d2-b7e9-032a2a0eb100.png)

And to no surprise, specifying shortname and a fresh set of creds also works perfectly fine:

![image](https://user-images.githubusercontent.com/503974/188738033-71497c78-d22c-4632-a457-26c5f14a60a8.png)

Why this happens makes perfect sense if you run `Get-WSManCredSSP`. Only the FQDN of the "local machine" is specified in WSMan for delegating creds:

![image](https://user-images.githubusercontent.com/503974/188736992-ac63db36-60cf-443c-bca8-c61bd6e5c1b8.png)

Other than hacking up the Powershell module to use FQDN, I am unsure how to proceed here.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.