winrm 2.0.3 → 2.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (127) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +10 -10
  3. data/.rubocop.yml +26 -26
  4. data/.travis.yml +11 -11
  5. data/Gemfile +3 -3
  6. data/README.md +260 -233
  7. data/Rakefile +34 -34
  8. data/Vagrantfile +6 -6
  9. data/WinrmAppveyor.psm1 +31 -31
  10. data/appveyor.yml +51 -51
  11. data/changelog.md +104 -101
  12. data/lib/winrm.rb +39 -39
  13. data/lib/winrm/connection.rb +83 -82
  14. data/lib/winrm/connection_opts.rb +91 -91
  15. data/lib/winrm/exceptions.rb +76 -76
  16. data/lib/winrm/http/response_handler.rb +96 -96
  17. data/lib/winrm/http/transport.rb +424 -424
  18. data/lib/winrm/http/transport_factory.rb +68 -68
  19. data/lib/winrm/output.rb +59 -59
  20. data/lib/winrm/psrp/create_pipeline.xml.erb +167 -167
  21. data/lib/winrm/psrp/fragment.rb +70 -70
  22. data/lib/winrm/psrp/init_runspace_pool.xml.erb +224 -224
  23. data/lib/winrm/psrp/message.rb +130 -130
  24. data/lib/winrm/psrp/message_data.rb +42 -42
  25. data/lib/winrm/psrp/message_data/base.rb +49 -49
  26. data/lib/winrm/psrp/message_data/error_record.rb +68 -68
  27. data/lib/winrm/psrp/message_data/pipeline_host_call.rb +32 -32
  28. data/lib/winrm/psrp/message_data/pipeline_output.rb +49 -49
  29. data/lib/winrm/psrp/message_data/pipeline_state.rb +40 -40
  30. data/lib/winrm/psrp/message_data/runspacepool_host_call.rb +32 -32
  31. data/lib/winrm/psrp/message_data/runspacepool_state.rb +39 -39
  32. data/lib/winrm/psrp/message_data/session_capability.rb +36 -36
  33. data/lib/winrm/psrp/message_defragmenter.rb +62 -62
  34. data/lib/winrm/psrp/message_factory.rb +75 -75
  35. data/lib/winrm/psrp/message_fragmenter.rb +60 -60
  36. data/lib/winrm/psrp/powershell_output_decoder.rb +139 -139
  37. data/lib/winrm/psrp/receive_response_reader.rb +97 -97
  38. data/lib/winrm/psrp/session_capability.xml.erb +7 -7
  39. data/lib/winrm/psrp/uuid.rb +40 -40
  40. data/lib/winrm/shells/base.rb +180 -175
  41. data/lib/winrm/shells/cmd.rb +65 -65
  42. data/lib/winrm/shells/power_shell.rb +202 -202
  43. data/lib/winrm/shells/retryable.rb +45 -45
  44. data/lib/winrm/shells/shell_factory.rb +58 -50
  45. data/lib/winrm/version.rb +7 -7
  46. data/lib/winrm/wsmv/base.rb +59 -59
  47. data/lib/winrm/wsmv/cleanup_command.rb +61 -61
  48. data/lib/winrm/wsmv/close_shell.rb +50 -50
  49. data/lib/winrm/wsmv/command.rb +101 -101
  50. data/lib/winrm/wsmv/command_output.rb +76 -76
  51. data/lib/winrm/wsmv/command_output_decoder.rb +55 -55
  52. data/lib/winrm/wsmv/configuration.rb +46 -46
  53. data/lib/winrm/wsmv/create_pipeline.rb +66 -66
  54. data/lib/winrm/wsmv/create_shell.rb +119 -119
  55. data/lib/winrm/wsmv/header.rb +203 -203
  56. data/lib/winrm/wsmv/init_runspace_pool.rb +95 -95
  57. data/lib/winrm/wsmv/iso8601_duration.rb +60 -60
  58. data/lib/winrm/wsmv/keep_alive.rb +68 -68
  59. data/lib/winrm/wsmv/receive_response_reader.rb +126 -126
  60. data/lib/winrm/wsmv/send_data.rb +68 -68
  61. data/lib/winrm/wsmv/soap.rb +51 -51
  62. data/lib/winrm/wsmv/wql_query.rb +79 -79
  63. data/lib/winrm/wsmv/write_stdin.rb +88 -88
  64. data/tests/integration/auth_timeout_spec.rb +18 -18
  65. data/tests/integration/cmd_spec.rb +131 -110
  66. data/tests/integration/config-example.yml +16 -16
  67. data/tests/integration/issue_59_spec.rb +26 -26
  68. data/tests/integration/powershell_spec.rb +165 -165
  69. data/tests/integration/spec_helper.rb +65 -65
  70. data/tests/integration/transport_spec.rb +99 -99
  71. data/tests/integration/wql_spec.rb +16 -16
  72. data/tests/matchers.rb +60 -60
  73. data/tests/spec/configuration_spec.rb +184 -184
  74. data/tests/spec/connection_spec.rb +39 -39
  75. data/tests/spec/exception_spec.rb +50 -50
  76. data/tests/spec/http/transport_factory_spec.rb +68 -68
  77. data/tests/spec/http/transport_spec.rb +44 -44
  78. data/tests/spec/output_spec.rb +127 -127
  79. data/tests/spec/psrp/fragment_spec.rb +62 -62
  80. data/tests/spec/psrp/message_data/base_spec.rb +13 -13
  81. data/tests/spec/psrp/message_data/error_record_spec.rb +41 -41
  82. data/tests/spec/psrp/message_data/pipeline_host_call_spec.rb +25 -25
  83. data/tests/spec/psrp/message_data/pipeline_output_spec.rb +32 -32
  84. data/tests/spec/psrp/message_data/pipeline_state_spec.rb +40 -40
  85. data/tests/spec/psrp/message_data/runspace_pool_host_call_spec.rb +25 -25
  86. data/tests/spec/psrp/message_data/runspacepool_state_spec.rb +16 -16
  87. data/tests/spec/psrp/message_data/session_capability_spec.rb +30 -30
  88. data/tests/spec/psrp/message_data_spec.rb +35 -35
  89. data/tests/spec/psrp/message_defragmenter_spec.rb +47 -47
  90. data/tests/spec/psrp/message_fragmenter_spec.rb +105 -105
  91. data/tests/spec/psrp/powershell_output_decoder_spec.rb +100 -100
  92. data/tests/spec/psrp/psrp_message_spec.rb +70 -70
  93. data/tests/spec/psrp/recieve_response_reader_spec.rb +172 -172
  94. data/tests/spec/psrp/uuid_spec.rb +28 -28
  95. data/tests/spec/response_handler_spec.rb +61 -61
  96. data/tests/spec/shells/base_spec.rb +202 -202
  97. data/tests/spec/shells/cmd_spec.rb +75 -75
  98. data/tests/spec/shells/powershell_spec.rb +175 -175
  99. data/tests/spec/spec_helper.rb +47 -47
  100. data/tests/spec/stubs/clixml/error_record.xml.erb +84 -84
  101. data/tests/spec/stubs/clixml/pipeline_state.xml.erb +88 -88
  102. data/tests/spec/stubs/responses/get_command_output_response.xml.erb +13 -13
  103. data/tests/spec/stubs/responses/get_command_output_response_not_done.xml.erb +10 -10
  104. data/tests/spec/stubs/responses/get_powershell_keepalive_response.xml.erb +10 -10
  105. data/tests/spec/stubs/responses/get_powershell_output_response.xml.erb +12 -12
  106. data/tests/spec/stubs/responses/get_powershell_output_response_not_done.xml.erb +9 -9
  107. data/tests/spec/stubs/responses/open_shell_v1.xml +19 -19
  108. data/tests/spec/stubs/responses/open_shell_v2.xml +20 -20
  109. data/tests/spec/stubs/responses/soap_fault_v1.xml +36 -36
  110. data/tests/spec/stubs/responses/soap_fault_v2.xml +42 -42
  111. data/tests/spec/stubs/responses/wmi_error_v2.xml +41 -41
  112. data/tests/spec/wsmv/cleanup_command_spec.rb +22 -22
  113. data/tests/spec/wsmv/close_shell_spec.rb +17 -17
  114. data/tests/spec/wsmv/command_output_decoder_spec.rb +37 -37
  115. data/tests/spec/wsmv/command_output_spec.rb +45 -45
  116. data/tests/spec/wsmv/command_spec.rb +19 -19
  117. data/tests/spec/wsmv/configuration_spec.rb +17 -17
  118. data/tests/spec/wsmv/create_pipeline_spec.rb +31 -31
  119. data/tests/spec/wsmv/create_shell_spec.rb +38 -38
  120. data/tests/spec/wsmv/init_runspace_pool_spec.rb +36 -36
  121. data/tests/spec/wsmv/keep_alive_spec.rb +21 -21
  122. data/tests/spec/wsmv/receive_response_reader_spec.rb +123 -123
  123. data/tests/spec/wsmv/send_data_spec.rb +30 -30
  124. data/tests/spec/wsmv/wql_query_spec.rb +13 -13
  125. data/tests/spec/wsmv/write_stdin_spec.rb +22 -22
  126. data/winrm.gemspec +42 -42
  127. metadata +2 -2
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: cdb9bfd4d44bdc3e671be670a00a0a56a26d0225
4
- data.tar.gz: 6f8dee428dbe911d59815d82c8cb26860047b3f6
3
+ metadata.gz: 8d4b16e96464a7881f8fe552ac2d0b60e42363fc
4
+ data.tar.gz: 0e3ee3ab3a43c347020480fe7f2a6d8a105a4472
5
5
  SHA512:
6
- metadata.gz: a0d1bd52c2fa18fd41959bbf03ecc2d5c2339cb33efc651d1adb707bb813aa7ff4f7cc1c539d08f2379629ecad95d43d87a96351512896f6798bf921b2e0e117
7
- data.tar.gz: 0f3bb047858ca2e1f3c8810f9073323c9d2daf67d05647d992a33b285e666d2e187620afaf8775cd0eadc9e5d7d187b10e4d921ac213426149e6c72ee938ad39
6
+ metadata.gz: 776782cd04b92e8c4c0d02c62c08678f56238124c2fc5ec57132566f6d130794468375c1886c5e59b7c7e604473674ea3a8b176749dcd187d2c7134662ee92ad
7
+ data.tar.gz: a7feae99fa3649c4c11baeefc91c129edd324f9c833a0ed097bef0c22bb18894ec0f6d0263fdf5885f4fa6f5b579363d98f6519de290c864478d7c5b39c06a85
data/.gitignore CHANGED
@@ -1,10 +1,10 @@
1
- *.swp
2
- *.gem
3
- pkg/*
4
- .rvmrc
5
- .idea
6
- .bundle
7
- tests/integration/config.yml
8
- traces/
9
- Gemfile.lock
10
- .vagrant
1
+ *.swp
2
+ *.gem
3
+ pkg/*
4
+ .rvmrc
5
+ .idea
6
+ .bundle
7
+ tests/integration/config.yml
8
+ traces/
9
+ Gemfile.lock
10
+ .vagrant
@@ -1,26 +1,26 @@
1
- AllCops:
2
- Exclude:
3
- - 'appveyor.yml'
4
- - 'Vagrantfile'
5
- - 'scripts/**/*'
6
-
7
- Style/Encoding:
8
- Enabled: true
9
-
10
- Style/NumericLiterals:
11
- Enabled: false
12
-
13
- Metrics/LineLength:
14
- Max: 100
15
-
16
- Metrics/MethodLength:
17
- Max: 20
18
-
19
- ModuleLength:
20
- Max: 250
21
-
22
- ClassLength:
23
- Max: 250
24
-
25
- Metrics/AbcSize:
26
- Max: 25
1
+ AllCops:
2
+ Exclude:
3
+ - 'appveyor.yml'
4
+ - 'Vagrantfile'
5
+ - 'scripts/**/*'
6
+
7
+ Style/Encoding:
8
+ Enabled: true
9
+
10
+ Style/NumericLiterals:
11
+ Enabled: false
12
+
13
+ Metrics/LineLength:
14
+ Max: 100
15
+
16
+ Metrics/MethodLength:
17
+ Max: 20
18
+
19
+ ModuleLength:
20
+ Max: 250
21
+
22
+ ClassLength:
23
+ Max: 250
24
+
25
+ Metrics/AbcSize:
26
+ Max: 25
@@ -1,11 +1,11 @@
1
- language: ruby
2
- rvm:
3
- - 2.0.0
4
- - 2.1.0
5
- before_install:
6
- - gem update bundler
7
-
8
- # This prevents testing branches that are created just for PRs
9
- branches:
10
- only:
11
- - master
1
+ language: ruby
2
+ rvm:
3
+ - 2.0.0
4
+ - 2.1.0
5
+ before_install:
6
+ - gem update bundler
7
+
8
+ # This prevents testing branches that are created just for PRs
9
+ branches:
10
+ only:
11
+ - master
data/Gemfile CHANGED
@@ -1,3 +1,3 @@
1
- # encoding: UTF-8
2
- source 'https://rubygems.org'
3
- gemspec
1
+ # encoding: UTF-8
2
+ source 'https://rubygems.org'
3
+ gemspec
data/README.md CHANGED
@@ -1,233 +1,260 @@
1
- # Windows Remote Management (WinRM) for Ruby
2
- [![Build Status](https://travis-ci.org/WinRb/WinRM.svg?branch=master)](https://travis-ci.org/WinRb/WinRM)
3
- [![Gem Version](https://badge.fury.io/rb/winrm.svg)](http://badge.fury.io/rb/winrm)
4
- [![Build status](https://ci.appveyor.com/api/projects/status/ods9tvos78k5c15h?svg=true)](https://ci.appveyor.com/project/winrb/winrm)
5
-
6
- This is a SOAP library that uses the functionality in Windows Remote
7
- Management(WinRM) to call native object in Windows. This includes, but is
8
- not limited to, running batch scripts, powershell scripts and fetching WMI
9
- variables. For more information on WinRM, please visit [Microsoft's WinRM
10
- site](http://msdn.microsoft.com/en-us/library/aa384426.aspx).
11
-
12
- As of version 2.0, this gem retains the WinRM name but all powershell calls use the more modern [Powershell Remoting Protocol (PSRP)](https://msdn.microsoft.com/en-us/library/dd357801.aspx) for initializing runspace pools as well as creating and processing powershell pipelines.
13
-
14
- ## Supported WinRM Versions
15
- WinRM 1.1 is supported, however 2.0 and higher is recommended. [See MSDN](http://technet.microsoft.com/en-us/library/ff520073.aspx) for information about WinRM versions and supported operating systems.
16
-
17
- ## Install
18
- `gem install -r winrm` then on the server `Enable-PSRemoting -Force` (already enabled on server operating systems 2012 and above) as admin
19
-
20
- ## Example
21
- ```ruby
22
- require 'winrm'
23
- opts = {
24
- endpoint: 'http://myhost:5985/wsman',
25
- user: 'administrator',
26
- password: 'Pass@word1'
27
- }
28
- conn = WinRM::Connection.new(opts)
29
- conn.shell(:powershell) do |shell|
30
- output = shell.run('$PSVersionTable') do |stdout, stderr|
31
- STDOUT.print stdout
32
- STDERR.print stderr
33
- end
34
- puts "The script exited with exit code #{output.exitcode}"
35
- end
36
- ```
37
-
38
- ## Connection Options
39
- There are various connection options you can specify upon initializing a WinRM connection object:
40
-
41
- * `:transport` - The type of underlying connection transport to use (more on this below). Defaults to `:negotiate`
42
- * `:locale` - The locale requested for response text formatting. This is the value sent in the `DataLocale` and `Locale` header values and defaults to `en-us`
43
- * `:max_envelope_size` - mazimum number of bytes expected for WinRM responses. This defaults to 153600
44
- * `:operation_timeout` - The maximum amount of time to wait for a response from the endpoint. This defaults to 60 seconds. Note that this will not "timeout" commands that exceed this amount of time to process, it just requires the endpoint to report the status of the command before the given amount of time passes.
45
- * `:receive_timeout` - The amount of time given to the underlying HTTP connection to respond before timing out. The defaults to 10 seconds longer than the `:operation_timeout`.
46
- * `:retry_limit` - the maximum number of times to retry opening a shell after failure. This defaults to 3.
47
- * `:retry_delay` - the amount of time to wait between retries and defaults to 10 seconds
48
- * `:user` - username used to authenticate over the `:transport`
49
- * `:password` - password used to authenticate over the `:transport`
50
-
51
- There are other options that may apply depending on the type of `:transport` used and are discussed below.
52
-
53
- ## Transports
54
-
55
- The transport used governs the authentication method used and the encryption level used for the underlying HTTP communication with the endpoint. The WinRM gem supports the following transport types:
56
-
57
- ### `:negotiate`
58
- ```ruby
59
- WinRM::Connection.new(
60
- endpoint: 'http://myhost:5985/wsman',
61
- transport: :negotiate,
62
- user: 'administrator',
63
- password: 'Pass@word1'
64
- )
65
- ```
66
-
67
- The `:negotiate` transport uses the [rubyntlm gem](https://github.com/WinRb/rubyntlm) to authenticate with the endpoint using the NTLM protocol. This uses an HTTP based connection but the SOAP message payloads are encrypted. If using HTTP (as opposed to HTTPS) this is the recommended transport. This is also the default transport used if none is specified in the connection options.
68
-
69
- ### `:ssl`
70
- ```ruby
71
- WinRM::Connection.new(
72
- endpoint: 'https://myhost:59856/wsman',
73
- transport: :ssl,
74
- user: 'administrator',
75
- password: 'Pass@word1'
76
- )
77
- ```
78
-
79
- The `:ssl` transport establishes a connection to the winrm endpoint over a secure sockets layer transport encrypting the entire message. Here are some additional connecion options available to `:ssl` connections:
80
-
81
- * `:client_cert` - Either a string path to a certificate `.pem` file or a `X509::Certificate` object. This along with an accompanying `:client_key` can be used in lieu of a `:user` and `:password`.
82
- * `:client_key` - the path to the private key file accompanying the above mentioned `:client_cert` or an `PKey::Pkey` object.
83
- * `:key_pass` - the optional password if necessary to access the `:client_cert`
84
- * `:no_ssl_peer_verification` - when set to `true` ssl certificate validation is not performed. With a self signed cert, its a match made in heaven!
85
- * `:ssl_peer_fingerprint` - when this is provided, normal certificate validation is skipped and instead the given fingerprint is matched against the certificate of the endpoint for verification.
86
- * `:ca_trust_path` - the path to a certificate `.pem` file to trust. Its similar to the `:ssl_peer_fingerprint` but contains the entire certificate to trust.
87
-
88
- ### `:kerberos`
89
- ```ruby
90
- WinRM::Connection.new(
91
- endpoint: 'http://myhost:5985/wsman',
92
- transport: :kerberos,
93
- realm: 'kerberos_realm'
94
- )
95
- ```
96
-
97
- Uses `:kerberos` to authenticate with the endpoint. These additional connection options may be used:
98
-
99
- * `:service` - kerberos service used to authenticate with the endpoint. Defaults to `HTTP`.
100
- * `:realm` - Kerberos realm to authenticate against.
101
-
102
- ### `:plaintext`
103
- Note: It is strongly recommended that you use `:negotiate` instead of `:plaintext`. As the name infers, the `:plaintext` transport includes authentication credentials in plain text.
104
- ```ruby
105
- WinRM::Connection.new(
106
- endpoint: 'http://myhost:5985/wsman',
107
- transport: :plaintext,
108
- user: 'administrator',
109
- password: 'Pass@word1',
110
- basic_auth_only: true
111
- )
112
- ```
113
-
114
- Additional supported connection options:
115
-
116
- * `:basic_auth_only` - Force basic authentication
117
- * `:disable_sspi` - Disable SSPI Negotiation authentication
118
-
119
- ## Shells
120
-
121
- As of the WinRM gem version 2, one creates a shell for executing commands by calling the `shell` method of a WinRM connection. There are two types of shells available:
122
-
123
- * `:cmd` - initiates a traditional cmd.exe shell via the WinRM protocol
124
- * `:powershell` - initiates a powershell runspace via the PSRP protocol
125
-
126
- Both shells support the same public methods: `:open`, `:close`, and `run`. Note that when given a shell, it is opened automatically upon executing the first command via `:run`. Further, `close` is called automatically when a `shell` is garbage collected or when using a shell from a block. However, it is always a good idea to proactively `close` a shell.
127
-
128
- ## Executing a WQL Query
129
- ```ruby
130
- opts = {
131
- endpoint: 'http://myhost:5985/wsman',
132
- user: 'administrator',
133
- password: 'Pass@word1'
134
- }
135
- conn = WinRM::Connection.new(opts)
136
-
137
- out = conn.run_wql('select * from Win32_OperatingSystem')
138
- output_caption = out[:win32_operating_system][0][:caption]
139
- ```
140
-
141
- ## Create a self signed cert for WinRM
142
- You may want to create a self signed certificate for servicing https WinRM connections. You can use the following PowerShell script to create a cert and enable the WinRM HTTPS listener. Unless you are running windows server 2012 R2 or later, you must install makecert.exe from the Windows SDK, otherwise use `New-SelfSignedCertificate`.
143
-
144
- ```powershell
145
- $hostname = $Env:ComputerName
146
-
147
- C:\"Program Files"\"Microsoft SDKs"\Windows\v7.1\Bin\makecert.exe -r -pe -n "CN=$hostname,O=vagrant" -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 "$hostname.cer"
148
-
149
- $thumbprint = (& ls cert:LocalMachine/my).Thumbprint
150
-
151
- # Windows 2012R2 and above can use New-SelfSignedCertificate
152
- $thumbprint = (New-SelfSignedCertificate -DnsName $hostname -CertStoreLocation cert:\LocalMachine\my).Thumbprint
153
-
154
- $cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"$hostname`";CertificateThumbprint=`"$thumbprint`"}'"
155
- iex $cmd
156
- ```
157
-
158
- ## Setting up Certificate based authentication
159
- Perform the following steps to authenticate with a certificate instead of a username and password:
160
-
161
- 1. Generate a certificate with an Extended Key Usage of Client Authentication and a Subject Alternative Name with the UPN of the user. See this [powershell function](https://github.com/WinRb/WinRM/blob/master/WinrmAppveyor.psm1#L1) as an example of using `openssl` to create a self signed user certificate in `.pem` and `.pfx` formats along with the private key file.
162
-
163
- 2. Import the pfx file into the `TrustedPeople` directory of the `LocalMachine` certificate store on the windows endpoint.
164
-
165
- 3. Import the issuing certificate authority certificate in the endpoint's `Root` certificates. If your client certificate is self signed, this will be the client certificate.
166
-
167
- 4. Enable certificate authentication on the endpoint: `Set-Item -Path WSMan:\localhost\Service\Auth\Certificate -Value $true`
168
-
169
- 5. Add a winrm user mapping for the issuing certificate: `New-Item -Path WSMan:\localhost\ClientCertificate -Subject <user UPN> -URI * -Issuer <issuing certificate thumbprint> -Credential (Get-Credential) -Force`
170
-
171
- See [this post](http://www.hurryupandwait.io/blog/certificate-password-less-based-authentication-in-winrm) for more details on certificate authentication.
172
-
173
- ## Logging
174
- The `WinRM::Connection` exposes a `logger` attribute and uses the [logging](https://rubygems.org/gems/logging) gem to manage logging behavior. By default this appends to `STDOUT` and has a level of `:warn`, but one can adjust the level or add additional appenders.
175
- ```ruby
176
- conn = WinRM::Connection.new(opts)
177
-
178
- # suppress warnings
179
- conn.logger.level = :error
180
-
181
- # Log to a file
182
- conn.logger.add_appenders(Logging.appenders.file('error.log'))
183
- ```
184
-
185
- If a consuming application uses its own logger that complies to the logging API, you can simply swap it in:
186
- ```ruby
187
- conn.logger = my_logger
188
- ```
189
-
190
- ## Troubleshooting
191
- You may have some errors like ```WinRM::WinRMAuthorizationError```. See [this post](http://www.hurryupandwait.io/blog/understanding-and-troubleshooting-winrm-connection-and-authentication-a-thrill-seekers-guide-to-adventure) for tips and troubleshooting steps related to winrm connection and authentication issues.
192
-
193
- ## Contributing
194
-
195
- 1. Fork it.
196
- 2. Create a branch (git checkout -b my_feature_branch)
197
- 3. Run the unit and integration tests (bundle exec rake integration)
198
- 4. Commit your changes (git commit -am "Added a sweet feature")
199
- 5. Push to the branch (git push origin my_feature_branch)
200
- 6. Create a pull requst from your branch into master (Please be sure to provide enough detail for us to cipher what this change is doing)
201
-
202
- ### Running the tests
203
-
204
- We use Bundler to manage dependencies during development.
205
-
206
- ```
207
- $ bundle install
208
- ```
209
-
210
- Once you have the dependencies, you can run the unit tests with `rake`:
211
-
212
- ```
213
- $ bundle exec rake spec
214
- ```
215
-
216
- To run the integration tests you will need a Windows box with the WinRM service properly configured. Its easiest to use a Vagrant Windows box (mwrock/Windows2012R2 is public on [atlas](https://atlas.hashicorp.com/mwrock/boxes/Windows2012R2) with an evaluation version of Windows 2012 R2). You can also use `mwrock/WindowsNano` provided in this repo's `Vagrantfile`.
217
-
218
- 1. Create a Windows VM with WinRM configured (see above).
219
- 2. Copy the config-example.yml to config.yml - edit this file with your WinRM connection details.
220
- 3. Run `bundle exec rake integration`
221
-
222
- ## WinRM Author
223
- * Twitter: [@zentourist](https://twitter.com/zentourist)
224
- * BLOG: [http://distributed-frostbite.blogspot.com/](http://distributed-frostbite.blogspot.com/)
225
- * Add me in LinkedIn: [http://www.linkedin.com/in/danwanek](http://www.linkedin.com/in/danwanek)
226
- * Find me on irc.freenode.net in #ruby-lang (zenChild)
227
-
228
- ## Maintainers
229
- * Paul Morton (https://github.com/pmorton)
230
- * Shawn Neal (https://github.com/sneal)
231
- * Matt Wrock (https://github.com/mwrock)
232
-
233
- [Contributors](https://github.com/WinRb/WinRM/graphs/contributors)
1
+ # Windows Remote Management (WinRM) for Ruby
2
+ [![Build Status](https://travis-ci.org/WinRb/WinRM.svg?branch=master)](https://travis-ci.org/WinRb/WinRM)
3
+ [![Gem Version](https://badge.fury.io/rb/winrm.svg)](http://badge.fury.io/rb/winrm)
4
+ [![Build status](https://ci.appveyor.com/api/projects/status/ods9tvos78k5c15h?svg=true)](https://ci.appveyor.com/project/winrb/winrm)
5
+
6
+ This is a SOAP library that uses the functionality in Windows Remote
7
+ Management(WinRM) to call native object in Windows. This includes, but is
8
+ not limited to, running batch scripts, powershell scripts and fetching WMI
9
+ variables. For more information on WinRM, please visit [Microsoft's WinRM
10
+ site](http://msdn.microsoft.com/en-us/library/aa384426.aspx).
11
+
12
+ As of version 2.0, this gem retains the WinRM name but all powershell calls use the more modern [Powershell Remoting Protocol (PSRP)](https://msdn.microsoft.com/en-us/library/dd357801.aspx) for initializing runspace pools as well as creating and processing powershell pipelines.
13
+
14
+ ## Supported WinRM Versions
15
+ WinRM 1.1 is supported, however 2.0 and higher is recommended. [See MSDN](http://technet.microsoft.com/en-us/library/ff520073.aspx) for information about WinRM versions and supported operating systems.
16
+
17
+ ## Install
18
+ `gem install -r winrm` then on the server `Enable-PSRemoting -Force` (already enabled on server operating systems 2012 and above) as admin
19
+
20
+ ## Example
21
+ ```ruby
22
+ require 'winrm'
23
+ opts = {
24
+ endpoint: 'http://myhost:5985/wsman',
25
+ user: 'administrator',
26
+ password: 'Pass@word1'
27
+ }
28
+ conn = WinRM::Connection.new(opts)
29
+ conn.shell(:powershell) do |shell|
30
+ output = shell.run('$PSVersionTable') do |stdout, stderr|
31
+ STDOUT.print stdout
32
+ STDERR.print stderr
33
+ end
34
+ puts "The script exited with exit code #{output.exitcode}"
35
+ end
36
+ ```
37
+
38
+ ## Connection Options
39
+ There are various connection options you can specify upon initializing a WinRM connection object:
40
+
41
+ * `:transport` - The type of underlying connection transport to use (more on this below). Defaults to `:negotiate`
42
+ * `:locale` - The locale requested for response text formatting. This is the value sent in the `DataLocale` and `Locale` header values and defaults to `en-us`
43
+ * `:max_envelope_size` - mazimum number of bytes expected for WinRM responses. This defaults to 153600
44
+ * `:operation_timeout` - The maximum amount of time to wait for a response from the endpoint. This defaults to 60 seconds. Note that this will not "timeout" commands that exceed this amount of time to process, it just requires the endpoint to report the status of the command before the given amount of time passes.
45
+ * `:receive_timeout` - The amount of time given to the underlying HTTP connection to respond before timing out. The defaults to 10 seconds longer than the `:operation_timeout`.
46
+ * `:retry_limit` - the maximum number of times to retry opening a shell after failure. This defaults to 3.
47
+ * `:retry_delay` - the amount of time to wait between retries and defaults to 10 seconds
48
+ * `:user` - username used to authenticate over the `:transport`
49
+ * `:password` - password used to authenticate over the `:transport`
50
+
51
+ There are other options that may apply depending on the type of `:transport` used and are discussed below.
52
+
53
+ ## Transports
54
+
55
+ The transport used governs the authentication method used and the encryption level used for the underlying HTTP communication with the endpoint. The WinRM gem supports the following transport types:
56
+
57
+ ### `:negotiate`
58
+ ```ruby
59
+ WinRM::Connection.new(
60
+ endpoint: 'http://myhost:5985/wsman',
61
+ transport: :negotiate,
62
+ user: 'administrator',
63
+ password: 'Pass@word1'
64
+ )
65
+ ```
66
+
67
+ The `:negotiate` transport uses the [rubyntlm gem](https://github.com/WinRb/rubyntlm) to authenticate with the endpoint using the NTLM protocol. This uses an HTTP based connection but the SOAP message payloads are encrypted. If using HTTP (as opposed to HTTPS) this is the recommended transport. This is also the default transport used if none is specified in the connection options.
68
+
69
+ ### `:ssl`
70
+ ```ruby
71
+ WinRM::Connection.new(
72
+ endpoint: 'https://myhost:59856/wsman',
73
+ transport: :ssl,
74
+ user: 'administrator',
75
+ password: 'Pass@word1'
76
+ )
77
+ ```
78
+
79
+ The `:ssl` transport establishes a connection to the winrm endpoint over a secure sockets layer transport encrypting the entire message. Here are some additional connecion options available to `:ssl` connections:
80
+
81
+ * `:client_cert` - Either a string path to a certificate `.pem` file or a `X509::Certificate` object. This along with an accompanying `:client_key` can be used in lieu of a `:user` and `:password`.
82
+ * `:client_key` - the path to the private key file accompanying the above mentioned `:client_cert` or an `PKey::Pkey` object.
83
+ * `:key_pass` - the optional password if necessary to access the `:client_cert`
84
+ * `:no_ssl_peer_verification` - when set to `true` ssl certificate validation is not performed. With a self signed cert, its a match made in heaven!
85
+ * `:ssl_peer_fingerprint` - when this is provided, normal certificate validation is skipped and instead the given fingerprint is matched against the certificate of the endpoint for verification.
86
+ * `:ca_trust_path` - the path to a certificate `.pem` file to trust. Its similar to the `:ssl_peer_fingerprint` but contains the entire certificate to trust.
87
+
88
+ ### `:kerberos`
89
+ ```ruby
90
+ WinRM::Connection.new(
91
+ endpoint: 'http://myhost:5985/wsman',
92
+ transport: :kerberos,
93
+ realm: 'kerberos_realm'
94
+ )
95
+ ```
96
+
97
+ Uses `:kerberos` to authenticate with the endpoint. These additional connection options may be used:
98
+
99
+ * `:service` - kerberos service used to authenticate with the endpoint. Defaults to `HTTP`.
100
+ * `:realm` - Kerberos realm to authenticate against.
101
+
102
+ ### `:plaintext`
103
+ Note: It is strongly recommended that you use `:negotiate` instead of `:plaintext`. As the name infers, the `:plaintext` transport includes authentication credentials in plain text.
104
+ ```ruby
105
+ WinRM::Connection.new(
106
+ endpoint: 'http://myhost:5985/wsman',
107
+ transport: :plaintext,
108
+ user: 'administrator',
109
+ password: 'Pass@word1',
110
+ basic_auth_only: true
111
+ )
112
+ ```
113
+
114
+ Additional supported connection options:
115
+
116
+ * `:basic_auth_only` - Force basic authentication
117
+ * `:disable_sspi` - Disable SSPI Negotiation authentication
118
+
119
+ ## Shells
120
+
121
+ As of the WinRM gem version 2, one creates a shell for executing commands by calling the `shell` method of a WinRM connection. There are two types of shells available:
122
+
123
+ * `:cmd` - initiates a traditional cmd.exe shell via the WinRM protocol
124
+ * `:powershell` - initiates a powershell runspace via the PSRP protocol
125
+
126
+ Both shells support the same public methods: `:open`, `:close`, and `run`. Note that when given a shell, it is opened automatically upon executing the first command via `:run`. Further, `close` is called automatically when a `shell` is garbage collected or when using a shell from a block. However, it is always a good idea to proactively `close` a shell.
127
+
128
+ ### Shell options supported by the `:cmd` shell
129
+
130
+ ```
131
+ shell_opts = {
132
+ env_vars: { 'FOO' => 'BAR' }
133
+ }
134
+ conn = WinRM::Connection.new(opts)
135
+ shell = conn.shell(:cmd, shell_opts)
136
+ ```
137
+
138
+ The `:cmd` shell supports a number of shell options that you can specify for the shell. There are safe defaults for all shell options and chances are that you will not need to override any of them. The available options are listed below.
139
+
140
+ * `:shell_uri` - WSMAN Resource URI. Defaults to `http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd` and you should not change this unless you hold the keys to the portal of eternity.
141
+ * `:i_stream` - A simple token list of all input streams the client will be using during execution. The only supported stream and the default is `stdin`.
142
+ * `:o_stream` - A simple token list of all output streams expected by the client. The supported streams and the defaults are `stdout` and `stderr`.
143
+ * `:codepage` - The `WINRS_CODEPAGE` which is the client's console output code page. The default is 65001 (UTF-8).
144
+ * `:noprofile` - The `WINRS_NOPROFILE` if set to `TRUE`, this option specifies that the user profile does not exist on the remote system and that the default profile should be used. By default, the value is `FALSE`.
145
+ * `:working_directory` - the starting directory that the Shell is to use for initialization.
146
+ * `:idle_timeout` - The remote winrm service will close and terminate the shell instance if it is idle for this many seconds. If the Shell is reused within this time limit, the countdown timer is reset once the command sequence is completed.
147
+ * `:env_vars` - a hash of EnvironmentVariable key/values, the starting set of environment variables that the Shell will use.
148
+
149
+ ### `:codepage` and working with legacy Windows versions
150
+
151
+ When using the `:cmd` shell, the default codepage used is `65001`. This works best accross locales on "modern" versions of Windows (Windows 7/Server 2008 R2 and later). Older versions may exhibit undesirable behavior under the 65001 codepage. The most common symptom is that commands invoking executables will return immediately with no output or errors.
152
+
153
+ When using these older versions of Windows, its best to use the native code page of the server's locale. For example, en-US servers will have a codepage of `437`. The `chcp` command can be used to determine the value of the native codepage.
154
+
155
+ ## Executing a WQL Query
156
+ ```ruby
157
+ opts = {
158
+ endpoint: 'http://myhost:5985/wsman',
159
+ user: 'administrator',
160
+ password: 'Pass@word1'
161
+ }
162
+ conn = WinRM::Connection.new(opts)
163
+
164
+ out = conn.run_wql('select * from Win32_OperatingSystem')
165
+ output_caption = out[:win32_operating_system][0][:caption]
166
+ ```
167
+
168
+ ## Create a self signed cert for WinRM
169
+ You may want to create a self signed certificate for servicing https WinRM connections. You can use the following PowerShell script to create a cert and enable the WinRM HTTPS listener. Unless you are running windows server 2012 R2 or later, you must install makecert.exe from the Windows SDK, otherwise use `New-SelfSignedCertificate`.
170
+
171
+ ```powershell
172
+ $hostname = $Env:ComputerName
173
+
174
+ C:\"Program Files"\"Microsoft SDKs"\Windows\v7.1\Bin\makecert.exe -r -pe -n "CN=$hostname,O=vagrant" -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 "$hostname.cer"
175
+
176
+ $thumbprint = (& ls cert:LocalMachine/my).Thumbprint
177
+
178
+ # Windows 2012R2 and above can use New-SelfSignedCertificate
179
+ $thumbprint = (New-SelfSignedCertificate -DnsName $hostname -CertStoreLocation cert:\LocalMachine\my).Thumbprint
180
+
181
+ $cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"$hostname`";CertificateThumbprint=`"$thumbprint`"}'"
182
+ iex $cmd
183
+ ```
184
+
185
+ ## Setting up Certificate based authentication
186
+ Perform the following steps to authenticate with a certificate instead of a username and password:
187
+
188
+ 1. Generate a certificate with an Extended Key Usage of Client Authentication and a Subject Alternative Name with the UPN of the user. See this [powershell function](https://github.com/WinRb/WinRM/blob/master/WinrmAppveyor.psm1#L1) as an example of using `openssl` to create a self signed user certificate in `.pem` and `.pfx` formats along with the private key file.
189
+
190
+ 2. Import the pfx file into the `TrustedPeople` directory of the `LocalMachine` certificate store on the windows endpoint.
191
+
192
+ 3. Import the issuing certificate authority certificate in the endpoint's `Root` certificates. If your client certificate is self signed, this will be the client certificate.
193
+
194
+ 4. Enable certificate authentication on the endpoint: `Set-Item -Path WSMan:\localhost\Service\Auth\Certificate -Value $true`
195
+
196
+ 5. Add a winrm user mapping for the issuing certificate: `New-Item -Path WSMan:\localhost\ClientCertificate -Subject <user UPN> -URI * -Issuer <issuing certificate thumbprint> -Credential (Get-Credential) -Force`
197
+
198
+ See [this post](http://www.hurryupandwait.io/blog/certificate-password-less-based-authentication-in-winrm) for more details on certificate authentication.
199
+
200
+ ## Logging
201
+ The `WinRM::Connection` exposes a `logger` attribute and uses the [logging](https://rubygems.org/gems/logging) gem to manage logging behavior. By default this appends to `STDOUT` and has a level of `:warn`, but one can adjust the level or add additional appenders.
202
+ ```ruby
203
+ conn = WinRM::Connection.new(opts)
204
+
205
+ # suppress warnings
206
+ conn.logger.level = :error
207
+
208
+ # Log to a file
209
+ conn.logger.add_appenders(Logging.appenders.file('error.log'))
210
+ ```
211
+
212
+ If a consuming application uses its own logger that complies to the logging API, you can simply swap it in:
213
+ ```ruby
214
+ conn.logger = my_logger
215
+ ```
216
+
217
+ ## Troubleshooting
218
+ You may have some errors like ```WinRM::WinRMAuthorizationError```. See [this post](http://www.hurryupandwait.io/blog/understanding-and-troubleshooting-winrm-connection-and-authentication-a-thrill-seekers-guide-to-adventure) for tips and troubleshooting steps related to winrm connection and authentication issues.
219
+
220
+ ## Contributing
221
+
222
+ 1. Fork it.
223
+ 2. Create a branch (git checkout -b my_feature_branch)
224
+ 3. Run the unit and integration tests (bundle exec rake integration)
225
+ 4. Commit your changes (git commit -am "Added a sweet feature")
226
+ 5. Push to the branch (git push origin my_feature_branch)
227
+ 6. Create a pull requst from your branch into master (Please be sure to provide enough detail for us to cipher what this change is doing)
228
+
229
+ ### Running the tests
230
+
231
+ We use Bundler to manage dependencies during development.
232
+
233
+ ```
234
+ $ bundle install
235
+ ```
236
+
237
+ Once you have the dependencies, you can run the unit tests with `rake`:
238
+
239
+ ```
240
+ $ bundle exec rake spec
241
+ ```
242
+
243
+ To run the integration tests you will need a Windows box with the WinRM service properly configured. Its easiest to use a Vagrant Windows box (mwrock/Windows2012R2 is public on [atlas](https://atlas.hashicorp.com/mwrock/boxes/Windows2012R2) with an evaluation version of Windows 2012 R2). You can also use `mwrock/WindowsNano` provided in this repo's `Vagrantfile`.
244
+
245
+ 1. Create a Windows VM with WinRM configured (see above).
246
+ 2. Copy the config-example.yml to config.yml - edit this file with your WinRM connection details.
247
+ 3. Run `bundle exec rake integration`
248
+
249
+ ## WinRM Author
250
+ * Twitter: [@zentourist](https://twitter.com/zentourist)
251
+ * BLOG: [http://distributed-frostbite.blogspot.com/](http://distributed-frostbite.blogspot.com/)
252
+ * Add me in LinkedIn: [http://www.linkedin.com/in/danwanek](http://www.linkedin.com/in/danwanek)
253
+ * Find me on irc.freenode.net in #ruby-lang (zenChild)
254
+
255
+ ## Maintainers
256
+ * Paul Morton (https://github.com/pmorton)
257
+ * Shawn Neal (https://github.com/sneal)
258
+ * Matt Wrock (https://github.com/mwrock)
259
+
260
+ [Contributors](https://github.com/WinRb/WinRM/graphs/contributors)