Skip to content

Knowledge Base · Category 20

Appendix: WinRM and SSH setup

4 articles

Windows targets are reached via WinRM, Linux targets via SSH. This appendix shows how to prepare both with least privilege. The tab Helper of each deployment shows the same steps tailored to the deployment type, and the dry run verifies them. For Linux targets, the least-privilege wrappers and sudoers files come only from Show script… in the tab Helper of the deployment. For Windows targets, the tab Helper lists the minimum rights of the account and the WinRM settings described below. The Desktop Admin console and the WebUI show the same tab Helper and the same script; in the WebUI, copy the script and run it yourself.

Articles in this category

  1. 20.1

    WinRM within the domain

    For every WinRM connection, TLSPilot prefers HTTPS on port 5986 with full validation of the listener certificate: the chain must end at a root certificate trusted on the management host, and the certificate must be issued for the host name entered in the deployment.

  2. 20.2

    WinRM outside the domain

    For a target in a workgroup, in a DMZ or in a domain without trust, Kerberos is not available.

  3. 20.3

    SSH for Linux targets

    For Nginx, Apache, HAProxy and Tomcat, the SSH user writes the certificates only through least-privilege wrappers.

  4. 20.4

    Typical errors