Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to remotely start VMWare virtual machines (I own VMWare Workstation) and to this end I need to execute on host something like "vmrun -T ws H:\VMWare\VM1\VM1.vmx nogui" with user desktop context, so launching it from ssh (which runs from the service and doesn't have access to desktop) is not an option.

I know that psexec will work, but this tool has inherent security issues, starting with the need to expose administrative share (which is on by default, but good practice is to disable it) and ending with ease of eavesdropping (more on the topic here).

Maybe someone here knows how to harden it, by for instance tunneling part of traffic inbound to port 443 on host (which is used by psexec) with ssh (only part, because I need to be able to use SMB shares)?

Or better yet, how to make sshd run interactively so it will give (I presume) access to the user's desktop? Or maybe there exist some custom client-server software, which would help with service-mode sshd (e.g. implementing the technique described here)?

Thank you for your help.

I have asked similar question here, on stackoverflow, but for different audience and from different angle.

share|improve this question
    
Take a look at Hamachi. Very easy and free quick vpn so you can layer psexec into a secure connection. –  Scheed Apr 19 '12 at 7:01
    
As of March 8, 2014 PsExec now "encrypts all communication between local and remote systems, including the transmission of command information such as the user name and password under which the remote program executes." –  Mick May 1 at 15:03

4 Answers 4

As of March 7, 2014 PsExec now "encrypts all communication between local and remote systems, including the transmission of command information such as the user name and password under which the remote program executes."

http://blogs.technet.com/b/sysinternals/archive/2014/03/07/updates-process-explorer-v16-02-process-monitor-v3-1-psexec-v2-1-sigcheck-v2-03.aspx

share|improve this answer

Give a look to RemoteExec: http://www.isdecisions.com/products/remoteexec/ (free, fully-functional trial)

This software solution is agentless and encrypted and will allow you to remotely and securely execute actions.

You will also find a comparative analysis between RemoteExec and PsExec here: http://blog.isdecisions.com/post/13298789101/remoteexec-vs-psexec-not-is-the-same-league

share|improve this answer
    
Thank you, I didn't know this software. Yes, at least the traffic is encrypted, but according to the manual the handshake still uses standard Windows protocol, and the $ADMIN share is needed. And the sheer size and the complexity of this application is an overkill in my situation. I suspect that if someone would know how to run sshd on Windows interactively (not as service) it might elegantly and easily solve the problem. If not - then this software is next solution. –  Adam Ryczkowski Apr 19 '12 at 12:34

Is this a windows enviroment?

If powershell is an option maybe try something along these lines?

Powershell Invoke-Command CMDLET

share|improve this answer
    
Thank you for your answer. Yes, it is Windows 7 host. I don't know this command, and certainly will give it a look. But I suspect it will use the same protocol as PsExec and RemoteExec for authentication. I prefer to avoid it, if possible. –  Adam Ryczkowski Apr 19 '12 at 13:09
    
Adam, since this is builtin to windows it should use typical windows authentication over the network which should be relively safe. There are also ways to send your autentication securely in the script see social.technet.microsoft.com/wiki/contents/articles/… for more information. –  dc5553 Apr 19 '12 at 13:28
up vote 1 down vote accepted

I Finally found the solution that suits me the best, because it doesn't rely on Windows authorization.

The point is to not to run sshd as a Windows service, but from user's personal startup (possibly as a hidden window). That's all. The only trick here is that I need to run it as elevated process.

To launch cygwin sshd interactively in Windows 7 one needs to follow these steps. They are mirrored from my post in superuser forum for your conveniece.

(I assume, that cygwin is installed to C:\cygwin, and that it contains the openssh package):

  1. Set the sshd service in Administrative Tools\services applet to "Manual launch" or "Disabled"
  2. Take ownership of C:\cygwin\var\empty folder
  3. (optional - for debug) Make sure, that when you run /usr/bin/sshd -D under elevated cygwin prompt you get ssh access to your host.
  4. (optional - for debug) Make sure that when you launch C:\cygwin\bin\run -p C:\cygwin\bin /usr/sbin/sshd -D from elevated command prompt you still get the same access as in point 3. Remember to kill the sshd.exe process afterwards using task manager.
  5. Create new task which launches this command under elevated credentials just after you log-in. See this forum thread to see how to do this
  6. Log-in with ssh from remote host and run the vmrun -T ws start ... command as you would do it locally, and everything works as expected.

I hope it helps those of you, who prefer to stick with ssh authorization for performing administrative tasks.

Please note, that for it to work the user need to actually log into the host (I believe it is best to do it interactively (i.e. not through rdp), but I have not tested this theory) so this solution is best suited for home/small office network, and perhaps it is not suited for a dedicated server, unless you configure it with "autologon" (but the autologon has security issues of its own which can easily offset the benefits of disabling $ADMIN share)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.