Skip to content

Disallow Basic Auth over HTTP on Unix #6787

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TravisEz13 merged 2 commits into from
May 2, 2018
Merged

Disallow Basic Auth over HTTP on Unix #6787

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1c00d45
Disallow Basic Auth over HTTP
dantraMSFT May 1, 2018
b0ac828
PR Feedback
dantraMSFT May 2, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions src/System.Management.Automation/engine/remoting/fanin/WSManTransportManager.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1526,6 +1526,15 @@ private void Initialize(Uri connectionUri, WSManConnectionInfo connectionInfo)
// config provider.
SetWSManSessionOption(WSManNativeApi.WSManSessionOption.WSMAN_OPTION_USE_SSL, 1);
}

#if UNIX
// explicitly disallow Basic auth over HTTP on Unix.
if (connectionInfo.AuthenticationMechanism == AuthenticationMechanism.Basic && !isSSLSpecified)
{
throw new PSRemotingTransportException(PSRemotingErrorId.ConnectFailed, RemotingErrorIdStrings.BasicAuthOverHttpNotSupported);
}
#endif

if (connectionInfo.NoEncryption)
{
// send unencrypted messages
Expand Down
3 changes: 3 additions & 0 deletions src/System.Management.Automation/resources/RemotingErrorIdStrings.resx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1110,6 +1110,9 @@ All WinRM sessions connected to PowerShell session configurations, such as Micro
<data name="AuthenticationMechanismRequiresCredential" xml:space="preserve">
<value>{0} authentication requires an explicit user name and password. Specify the user name and password by using the -Credential parameter and try the command again.</value>
</data>
<data name="BasicAuthOverHttpNotSupported">
<value>Basic authentication is not supported over HTTP on Unix.</value>
</data>
<data name="StartJobDefinitionNotFound1" xml:space="preserve">
<value>Cannot find a scheduled job with name {0}.</value>
<comment>{0} is the job definition name</comment>
Expand Down
14 changes: 14 additions & 0 deletions test/powershell/engine/Remoting/RemoteSession.Basic.Tests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,20 @@ Describe "New-PSSession basic test" -Tag @("CI") {
}
}

Describe "Basic Auth over HTTP not allowed on Unix" -Tag @("CI") {
It "New-PSSession should throw when specifying Basic Auth over HTTP on Unix" -skip:($IsWindows) {
$password = ConvertTo-SecureString -String "password" -AsPlainText -Force
$credential = [PSCredential]::new('username', $password)

$err = ({New-PSSession -ComputerName 'localhost' -Credential $credential -Authentication Basic} | Should -Throw -PassThru -ErrorId 'System.Management.Automation.Remoting.PSRemotingDataStructureException,Microsoft.PowerShell.Commands.NewPSSessionCommand')
$err.Exception | Should -BeOfType [System.Management.Automation.Remoting.PSRemotingTransportException]
# Should be PSRemotingErrorId.ConnectFailed
# Ensures we are looking at teh expected instance
$err.Exception.ErrorCode | Should -Be 801
}

}

Describe "JEA session Transcript script test" -Tag @("Feature", 'RequireAdminOnWindows') {
BeforeAll {
$originalDefaultParameterValues = $PSDefaultParameterValues.Clone()
Expand Down