mirror of
https://github.com/Grace-Solutions/Invoke-OpenSSHConfiguration.git
synced 2026-07-26 11:38:14 +00:00
Change auth methods to opt-out, keep key generation opt-in
Authentication methods now ENABLED by default (opt-out): - -DisablePubkeyAuthentication (was -EnablePubkeyAuthentication) - -DisablePasswordAuthentication (unchanged) - -DisableCertificateAuthentication (was -EnableCertificateAuthentication) Key generation remains OPT-IN: - -GenerateKeyPair still requires explicit use Config changes: - All auth settings now idempotent (only modify if value differs) - Certificate auth auto-enables if CA bundle exists - Disabling cert auth comments out TrustedUserCAKeys line Updated README with new parameter names and examples
This commit is contained in:
GraceSolutions
@@ -67,13 +67,13 @@
|
||||
[Int]$KeyBits,
|
||||
|
||||
[Parameter(Mandatory=$False)]
|
||||
[Switch]$EnablePubkeyAuthentication,
|
||||
[Switch]$DisablePubkeyAuthentication,
|
||||
|
||||
[Parameter(Mandatory=$False)]
|
||||
[Switch]$DisablePasswordAuthentication,
|
||||
|
||||
[Parameter(Mandatory=$False)]
|
||||
[Switch]$EnableCertificateAuthentication,
|
||||
[Switch]$DisableCertificateAuthentication,
|
||||
|
||||
[Parameter(Mandatory=$False)]
|
||||
[Switch]$TrustWindowsCertificateAuthorities,
|
||||
@@ -679,59 +679,65 @@ Switch (Test-ProcessElevationStatus)
|
||||
$SSHDConfigContent = [System.IO.File]::ReadAllText($SSHDConfigPath.FullName)
|
||||
$SSHDConfigModified = $False
|
||||
|
||||
#region Enable PubkeyAuthentication
|
||||
Switch ($EnablePubkeyAuthentication.IsPresent -eq $True)
|
||||
#region Configure PubkeyAuthentication (enabled by default, opt-out)
|
||||
$PubkeyAuthPattern = '(?m)^#?\s*PubkeyAuthentication\s+.*$'
|
||||
$PubkeyAuthValue = Switch ($DisablePubkeyAuthentication.IsPresent) { {($_ -eq $True)} {'no'} Default {'yes'} }
|
||||
$PubkeyAuthReplacement = "PubkeyAuthentication $($PubkeyAuthValue)"
|
||||
|
||||
Switch ($SSHDConfigContent -imatch $PubkeyAuthPattern)
|
||||
{
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$PubkeyAuthPattern = '(?m)^#?\s*PubkeyAuthentication\s+.*$'
|
||||
$PubkeyAuthReplacement = 'PubkeyAuthentication yes'
|
||||
$CurrentMatch = [System.Text.RegularExpressions.Regex]::Match($SSHDConfigContent, $PubkeyAuthPattern)
|
||||
|
||||
Switch ($SSHDConfigContent -imatch $PubkeyAuthPattern)
|
||||
Switch ($CurrentMatch.Value -ine $PubkeyAuthReplacement)
|
||||
{
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$SSHDConfigContent = [System.Text.RegularExpressions.Regex]::Replace($SSHDConfigContent, $PubkeyAuthPattern, $PubkeyAuthReplacement)
|
||||
$SSHDConfigModified = $True
|
||||
$WriteLogMessage.Invoke(0, @("Enabled PubkeyAuthentication."))
|
||||
}
|
||||
|
||||
Default
|
||||
{
|
||||
$SSHDConfigContent = $SSHDConfigContent + "`r`n$($PubkeyAuthReplacement)"
|
||||
$SSHDConfigModified = $True
|
||||
$WriteLogMessage.Invoke(0, @("Added PubkeyAuthentication setting."))
|
||||
$WriteLogMessage.Invoke(0, @("Configured PubkeyAuthentication: $($PubkeyAuthValue)"))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Default
|
||||
{
|
||||
$SSHDConfigContent = $SSHDConfigContent + "`r`n$($PubkeyAuthReplacement)"
|
||||
$SSHDConfigModified = $True
|
||||
$WriteLogMessage.Invoke(0, @("Added PubkeyAuthentication: $($PubkeyAuthValue)"))
|
||||
}
|
||||
}
|
||||
#endregion
|
||||
|
||||
#region Disable PasswordAuthentication
|
||||
Switch ($DisablePasswordAuthentication.IsPresent -eq $True)
|
||||
#region Configure PasswordAuthentication (enabled by default, opt-out)
|
||||
$PasswordAuthPattern = '(?m)^#?\s*PasswordAuthentication\s+.*$'
|
||||
$PasswordAuthValue = Switch ($DisablePasswordAuthentication.IsPresent) { {($_ -eq $True)} {'no'} Default {'yes'} }
|
||||
$PasswordAuthReplacement = "PasswordAuthentication $($PasswordAuthValue)"
|
||||
|
||||
Switch ($SSHDConfigContent -imatch $PasswordAuthPattern)
|
||||
{
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$PasswordAuthPattern = '(?m)^#?\s*PasswordAuthentication\s+.*$'
|
||||
$PasswordAuthReplacement = 'PasswordAuthentication no'
|
||||
$CurrentMatch = [System.Text.RegularExpressions.Regex]::Match($SSHDConfigContent, $PasswordAuthPattern)
|
||||
|
||||
Switch ($SSHDConfigContent -imatch $PasswordAuthPattern)
|
||||
Switch ($CurrentMatch.Value -ine $PasswordAuthReplacement)
|
||||
{
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$SSHDConfigContent = [System.Text.RegularExpressions.Regex]::Replace($SSHDConfigContent, $PasswordAuthPattern, $PasswordAuthReplacement)
|
||||
$SSHDConfigModified = $True
|
||||
$WriteLogMessage.Invoke(0, @("Disabled PasswordAuthentication."))
|
||||
}
|
||||
|
||||
Default
|
||||
{
|
||||
$SSHDConfigContent = $SSHDConfigContent + "`r`n$($PasswordAuthReplacement)"
|
||||
$SSHDConfigModified = $True
|
||||
$WriteLogMessage.Invoke(0, @("Added PasswordAuthentication setting (disabled)."))
|
||||
$WriteLogMessage.Invoke(0, @("Configured PasswordAuthentication: $($PasswordAuthValue)"))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Default
|
||||
{
|
||||
$SSHDConfigContent = $SSHDConfigContent + "`r`n$($PasswordAuthReplacement)"
|
||||
$SSHDConfigModified = $True
|
||||
$WriteLogMessage.Invoke(0, @("Added PasswordAuthentication: $($PasswordAuthValue)"))
|
||||
}
|
||||
}
|
||||
#endregion
|
||||
|
||||
@@ -775,38 +781,70 @@ Switch (Test-ProcessElevationStatus)
|
||||
}
|
||||
#endregion
|
||||
|
||||
#region Configure TrustedUserCAKeys for Certificate Authentication
|
||||
Switch (($EnableCertificateAuthentication.IsPresent -eq $True) -and ($TrustWindowsCertificateAuthorities.IsPresent -eq $True))
|
||||
#region Configure TrustedUserCAKeys for Certificate Authentication (enabled by default if CA bundle exists, opt-out)
|
||||
$CABundleFileName = 'OpenSSH-TrustedCertificateAuthorities-LocalMachine.pem'
|
||||
[System.IO.FileInfo]$CABundlePath = [System.IO.Path]::Combine($OpenSSHProgramDataDirectory.FullName, $CABundleFileName)
|
||||
|
||||
#Use __PROGRAMDATA__ variable for sshd_config (portable path)
|
||||
$CABundleConfigPath = "__PROGRAMDATA__/ssh/$($CABundleFileName)"
|
||||
|
||||
$TrustedCAKeysPattern = '(?m)^#?\s*TrustedUserCAKeys\s+.*$'
|
||||
|
||||
Switch ($DisableCertificateAuthentication.IsPresent -eq $True)
|
||||
{
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$CABundleFileName = 'OpenSSH-TrustedCertificateAuthorities-LocalMachine.pem'
|
||||
[System.IO.FileInfo]$CABundlePath = [System.IO.Path]::Combine($OpenSSHProgramDataDirectory.FullName, $CABundleFileName)
|
||||
|
||||
#Use __PROGRAMDATA__ variable for sshd_config (portable path)
|
||||
$CABundleConfigPath = "__PROGRAMDATA__/ssh/$($CABundleFileName)"
|
||||
|
||||
Switch ($CABundlePath.Exists)
|
||||
#Disable: Comment out TrustedUserCAKeys if it exists
|
||||
Switch ($SSHDConfigContent -imatch $TrustedCAKeysPattern)
|
||||
{
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$CurrentMatch = [System.Text.RegularExpressions.Regex]::Match($SSHDConfigContent, $TrustedCAKeysPattern)
|
||||
|
||||
Switch ($CurrentMatch.Value -inotmatch '^#')
|
||||
{
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$SSHDConfigContent = [System.Text.RegularExpressions.Regex]::Replace($SSHDConfigContent, $TrustedCAKeysPattern, "#$($CurrentMatch.Value)")
|
||||
$SSHDConfigModified = $True
|
||||
$WriteLogMessage.Invoke(0, @("Disabled TrustedUserCAKeys (commented out)."))
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Default
|
||||
{
|
||||
#Enable: Configure TrustedUserCAKeys if CA bundle exists
|
||||
Switch ($CABundlePath.Exists -eq $True)
|
||||
{
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$TrustedCAKeysPattern = '(?m)^#?\s*TrustedUserCAKeys\s+.*$'
|
||||
$TrustedCAKeysReplacement = "TrustedUserCAKeys $($CABundleConfigPath)"
|
||||
|
||||
Switch ($SSHDConfigContent -imatch $TrustedCAKeysPattern)
|
||||
{
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$SSHDConfigContent = [System.Text.RegularExpressions.Regex]::Replace($SSHDConfigContent, $TrustedCAKeysPattern, $TrustedCAKeysReplacement)
|
||||
$SSHDConfigModified = $True
|
||||
$WriteLogMessage.Invoke(0, @("Configured TrustedUserCAKeys to `"$($CABundleConfigPath)`"."))
|
||||
$CurrentMatch = [System.Text.RegularExpressions.Regex]::Match($SSHDConfigContent, $TrustedCAKeysPattern)
|
||||
|
||||
Switch ($CurrentMatch.Value -ine $TrustedCAKeysReplacement)
|
||||
{
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$SSHDConfigContent = [System.Text.RegularExpressions.Regex]::Replace($SSHDConfigContent, $TrustedCAKeysPattern, $TrustedCAKeysReplacement)
|
||||
$SSHDConfigModified = $True
|
||||
$WriteLogMessage.Invoke(0, @("Configured TrustedUserCAKeys: $($CABundleConfigPath)"))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Default
|
||||
{
|
||||
$SSHDConfigContent = $SSHDConfigContent + "`r`n$($TrustedCAKeysReplacement)"
|
||||
$SSHDConfigModified = $True
|
||||
$WriteLogMessage.Invoke(0, @("Added TrustedUserCAKeys setting."))
|
||||
$WriteLogMessage.Invoke(0, @("Added TrustedUserCAKeys: $($CABundleConfigPath)"))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user