Authentication methods now ENABLED by default (opt-out):
- -DisablePubkeyAuthentication (was -EnablePubkeyAuthentication)
- -DisablePasswordAuthentication (unchanged)
- -DisableCertificateAuthentication (was -EnableCertificateAuthentication)
Key generation remains OPT-IN:
- -GenerateKeyPair still requires explicit use
Config changes:
- All auth settings now idempotent (only modify if value differs)
- Certificate auth auto-enables if CA bundle exists
- Disabling cert auth comments out TrustedUserCAKeys line
Updated README with new parameter names and examples
- Query Win32_UserProfile by SID instead of Test-Path on registry
- Win32_UserProfile.Loaded property explicitly indicates hive status
- Added -Verbose:$False to suppress CIM query output
- Improved logging to show Loaded property value
- Cert:\CurrentUser resolves to PROCESS identity, not session user
- Now reads directly from HKEY_USERS\{SID}\Software\Microsoft\SystemCertificates\
- Parses certificate blobs from Root and CA store registry keys
- Only attempts if CurrentUserSession is available and hive is loaded
- Skips invalid certificate blobs gracefully
- Check if user's registry hive is loaded under HKEY_USERS\{SID}
- Use X509Store to access user's Root and CA stores via CurrentUserSession.SID
- Fallback to current process identity if user hive not loaded
- Log which user's certificates are being accessed
- Properly dedupe certificates from all stores by thumbprint
- Suppress Get-CIMInstance verbose output in Toolkit.ps1 with -Verbose:$False
- Add CurrentUser Root and CA stores alongside LocalMachine stores
- Dedupe certificates by Thumbprint (Sort-Object -Unique)
- Suppress verbose from Process Select-Object (triggers WMI queries)
- Use explicit property list instead of wildcard for process object
- TrustedUserCAKeys now uses __PROGRAMDATA__/ssh/... (portable path)
- Backup cleanup: keeps only the last 3 sshd_config backups
- Removes older backups automatically after creating new one
- Removed -Export switch when creating CA bundle (only bundle is needed)
- Individual certificate directories and PEM files are no longer created
- Only the combined CA bundle file is written to disk
- Updated Example 4 documentation to reflect correct usage
- Wrapped CNG key casting in try/catch for both public and private key extraction
- RSABCrypt and other non-CNG implementations now gracefully skip key blob export
- Certificate PEM blob still generated correctly (only separate key blobs affected)
- Demoted public key extraction failure from Warning to Verbose (non-critical)
- Added informative message about key implementation type on failure
- Added ExecutionTimeout and ExecutionTimeoutInterval to ssh-keygen calls (2 min timeout)
- Added ExecutionTimeout and ExecutionTimeoutInterval to sshd -t validation (30 sec timeout)
- Fixed firewall profile enumeration: use string array instead of unavailable type
- Profiles now use simple array: @('Domain', 'Private', 'Public')
- Service auto-start and start now happen automatically (no switches)
- Windows Firewall rules created automatically per profile (Domain, Private, Public)
- Dynamic profile enumeration using [Microsoft.PowerShell.Cmdletization.GeneratedTypes.NetSecurity.Profile]
- Added -SSHPort parameter for custom port (default: 22)
- Idempotent firewall rule creation with update support
- Removed -EnableService and -StartService switches (now automatic)
GraceSolutions