4 ms·

PowerShell has that whole execution policy thing, so you can't just launch a PowerShell script unless you wrap it in a batch file or some other script. I could

by ptx 3y ago

PowerShell has that whole execution policy thing, so you can't just launch a PowerShell script unless you wrap it in a batch file or some other script. I could see how allowing the user to whitelist individual scripts would make sense, but as far as I can tell that's not how it works? A blanket policy of "all scripts are forbidden unless wrapped with fragile and shady-looking hacks" doesn't seem particularly useful.

trelliscoded 3y ago
Disabling script signing on dev machines and requiring signatures on production scripts sounds like perfectly reasonable behavior to me. I know a lot of people are scared of pki but it’s way easier than people think. Signing things is a one liner, I keep certs on a portable HSM and it’s really low friction.
- theamk 3y ago
  Unless you suddenly get sick and your HSM is unavailable? Unless you get a 2nd person on the team (working remotely), and they want to be able to sign scripts as well? Unless you get some sort of automated CI/CD system?
  - MarkSweep 3y ago
    You can still turn off the script signing requirement without running a script (right?). Presumably this will be logged to the Windows Event Log, so there should be a mechanism that watches logs for this and alerts someone to investigate.
steve1977 3y ago
It's configurable with quite a few options. But I guess here we have some of the underlying problem. If something just executes whatever you throw at it, people complain. If something doesn't just execute whatever your throw it, people complain as well. ;)
- ptx 3y ago
  None of the options seem very useful, though. Why block execution of PowerShell scripts when batch files, WSH scripts and plain executables can still run? You could try to prevent those other kinds of scripts from even getting onto the machine, I guess, but then why wouldn't you simply do the same for PowerShell scripts? The AllSigned policy where it asks you explicitly about trusting new publishers[0] seems like what I'm asking for, except that it apparently requires the certificate to be installed in Trusted Root Certificate Authorities! That's way more trust than should be necessary. The only option that seems to make sense (aside from Unrestricted) is buying a certificate from an existing CA that's already trusted, so that users don't need to trust you with acting as a CA, but that's quite expensive. [0] https://www.hanselman.com/blog/signing-powershell-scripts https://www.hanselman.com/blog/signing-powershell-scripts

by ptx 3y ago

trelliscoded 3y ago

Disabling script signing on dev machines and requiring signatures on production scripts sounds like perfectly reasonable behavior to me. I know a lot of people are scared of pki but it’s way easier than people think. Signing things is a one liner, I keep certs on a portable HSM and it’s really low friction.

theamk 3y ago
Unless you suddenly get sick and your HSM is unavailable? Unless you get a 2nd person on the team (working remotely), and they want to be able to sign scripts as well? Unless you get some sort of automated CI/CD system?
- MarkSweep 3y ago
  You can still turn off the script signing requirement without running a script (right?). Presumably this will be logged to the Windows Event Log, so there should be a mechanism that watches logs for this and alerts someone to investigate.

steve1977 3y ago

It's configurable with quite a few options. But I guess here we have some of the underlying problem. If something just executes whatever you throw at it, people complain. If something doesn't just execute whatever your throw it, people complain as well. ;)

ptx 3y ago
None of the options seem very useful, though. Why block execution of PowerShell scripts when batch files, WSH scripts and plain executables can still run? You could try to prevent those other kinds of scripts from even getting onto the machine, I guess, but then why wouldn't you simply do the same for PowerShell scripts? The AllSigned policy where it asks you explicitly about trusting new publishers[0] seems like what I'm asking for, except that it apparently requires the certificate to be installed in Trusted Root Certificate Authorities! That's way more trust than should be necessary. The only option that seems to make sense (aside from Unrestricted) is buying a certificate from an existing CA that's already trusted, so that users don't need to trust you with acting as a CA, but that's quite expensive. [0] https://www.hanselman.com/blog/signing-powershell-scripts https://www.hanselman.com/blog/signing-powershell-scripts