Secure use of psexec or better alternative to it

Question

I want to remotely start VMWare virtual machines (I own VMWare Workstation) and to this end I need to execute on host something like "vmrun -T ws H:\VMWare\VM1\VM1.vmx nogui" with user desktop context, so launching it from ssh (which runs from the service and doesn't have access to desktop) is not an option.

I know that psexec will work, but this tool has inherent security issues, starting with the need to expose administrative share (which is on by default, but good practice is to disable it) and ending with ease of eavesdropping (more on the topic here).

Maybe someone here knows how to harden it, by for instance tunneling part of traffic inbound to port 443 on host (which is used by psexec) with ssh (only part, because I need to be able to use SMB shares)?

Or better yet, how to make sshd run interactively so it will give (I presume) access to the user's desktop? Or maybe there exist some custom client-server software, which would help with service-mode sshd (e.g. implementing the technique described here)?

Thank you for your help.

I have asked similar question here, on stackoverflow, but for different audience and from different angle.

Answer 1

Is this a windows enviroment?

If powershell is an option maybe try something along these lines?

Powershell Invoke-Command CMDLET

Answer 2

As of March 7, 2014 PsExec now "encrypts all communication between local and remote systems, including the transmission of command information such as the user name and password under which the remote program executes."

http://blogs.technet.com/b/sysinternals/archive/2014/03/07/updates-process-explorer-v16-02-process-monitor-v3-1-psexec-v2-1-sigcheck-v2-03.aspx

Answer 3

Give a look to RemoteExec: http://www.isdecisions.com/products/remoteexec/ (free, fully-functional trial)

This software solution is agentless and encrypted and will allow you to remotely and securely execute actions.

You will also find a comparative analysis between RemoteExec and PsExec here: http://blog.isdecisions.com/post/13298789101/remoteexec-vs-psexec-not-is-the-same-league

Answer 4

I Finally found the solution that suits me the best, because it doesn't rely on Windows authorization.

The point is to not to run sshd as a Windows service, but from user's personal startup (possibly as a hidden window). That's all. The only trick here is that I need to run it as elevated process.

To launch cygwin sshd interactively in Windows 7 one needs to follow these steps. They are mirrored from my post in superuser forum for your conveniece.

(I assume, that cygwin is installed to C:\cygwin, and that it contains the openssh package):

1. Set the sshd service in Administrative Tools\services applet to "Manual launch" or "Disabled"
2. Take ownership of C:\cygwin\var\empty folder
3. (optional - for debug) Make sure, that when you run /usr/bin/sshd -D under elevated cygwin prompt you get ssh access to your host.
4. (optional - for debug) Make sure that when you launch C:\cygwin\bin\run -p C:\cygwin\bin /usr/sbin/sshd -D from elevated command prompt you still get the same access as in point 3. Remember to kill the sshd.exe process afterwards using task manager.
5. Create new task which launches this command under elevated credentials just after you log-in. See this forum thread to see how to do this
6. Log-in with ssh from remote host and run the vmrun -T ws start ... command as you would do it locally, and everything works as expected.

I hope it helps those of you, who prefer to stick with ssh authorization for performing administrative tasks.

Please note, that for it to work the user need to actually log into the host (I believe it is best to do it interactively (i.e. not through rdp), but I have not tested this theory) so this solution is best suited for home/small office network, and perhaps it is not suited for a dedicated server, unless you configure it with "autologon" (but the autologon has security issues of its own which can easily offset the benefits of disabling $ADMIN share)