Add WinRM configuration files and download script for Zabbix integration
- Created ConfigWinRM.xml with options for WinRM configuration including firewall rules and authentication settings. - Added Download-WinRMConfigScript.ps1 to download the configuration files and update the trusted hosts for WinRM based on user input or parameter.
This commit is contained in:
Petr Štěpán
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,19 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<ConfigWinRM>
|
||||
<Options>
|
||||
<LocalAccountTokenFilterPolicy>Enable</LocalAccountTokenFilterPolicy> <!-- Enable / Disable / Leave ( do nothing ) -->
|
||||
<WinRMHTTP>Leave</WinRMHTTP> <!-- Enable ( Create ) / Disable ( Remove ) / Leave ( do nothing ) Win-RM HTTP Listener -->
|
||||
<WinRMHTTPS>Enable</WinRMHTTPS> <!-- Enable ( Create ) / Disable ( Remove ) / Leave ( do nothing ) Win-RM HTTPS Listener -->
|
||||
<FWWinRMHTTP>Leave</FWWinRMHTTP> <!-- Enable ( Enable or Create ) / Disable / Leave ( do nothing ) Win-RM HTTP firewall rule -->
|
||||
<FWWinRMHTTPS>Enable</FWWinRMHTTPS> <!-- Enable ( Enable or Create ) / Disable / Leave ( do nothing ) Win-RM HTTPS firewall rule -->
|
||||
<FWWinRMTrustedHosts>192.168.10.254</FWWinRMTrustedHosts> <!-- Host(s) that are allowed in local firewall configuration - Any / X.X.X.X - WinRM-(HTTPS-In) / Windows Remote Management (HTTPS-In) -->
|
||||
<SelfCertForce>False</SelfCertForce> <!-- Force issuing new self-signed certificate when old one exists and use for WinRM-HTTPS -->
|
||||
<SelfCertValidityDays>1460</SelfCertValidityDays> <!-- Self-certificate validity for XX Days. 1460 - 4 years. -->
|
||||
<BasicAuth>Disable</BasicAuth> <!-- Enable / Disable / Leave ( as ist ) -->
|
||||
<KerberosAuth>Enable</KerberosAuth> <!-- Enable / Disable / Leave ( as ist ) -->
|
||||
<CredSSPAuth>Enable</CredSSPAuth> <!-- Enable / Disable / Leave ( as ist ) -->
|
||||
<DigestAuth>Leave</DigestAuth> <!-- Enable / Disable / Leave ( as ist ) -->
|
||||
<NegotiateAuth>Leave</NegotiateAuth> <!-- Enable / Disable / Leave ( as ist ) Do NOT use, do NOT disable !!! :-) -->
|
||||
<CertificateAuth>Leave</CertificateAuth> <!-- Enable / Disable / Leave ( as ist ) -->
|
||||
</Options>
|
||||
</ConfigWinRM>
|
||||
@@ -0,0 +1,187 @@
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Downloads ConfigWinRM.ps1 and ConfigWinRM.xml to C:\WinRM and optionally sets the
|
||||
Zabbix Proxy IP address as the WinRM firewall trusted host.
|
||||
|
||||
.DESCRIPTION
|
||||
Downloads ConfigWinRM.ps1 and ConfigWinRM.xml from the internal Git server
|
||||
(git.totalservice.cz, WindowsServer repo) into C:\WinRM, creating that folder if it
|
||||
does not already exist. After the download, it asks for the Zabbix Proxy IP
|
||||
address: if one is entered, it is written into the <FWWinRMTrustedHosts> element of
|
||||
the downloaded ConfigWinRM.xml; if the prompt is left empty (Enter only),
|
||||
ConfigWinRM.xml is left unchanged. The IP address can also be supplied directly via
|
||||
the -ZabbixProxyIPAddress parameter to run the script non-interactively.
|
||||
|
||||
.PARAMETER ZabbixProxyIPAddress
|
||||
Zabbix Proxy IP address to allow through the WinRM firewall rule
|
||||
(FWWinRMTrustedHosts in ConfigWinRM.xml). Omit this parameter to be prompted
|
||||
interactively; pass an empty string to skip the prompt and leave the existing
|
||||
value in ConfigWinRM.xml unchanged.
|
||||
|
||||
.EXAMPLE
|
||||
PS> .\Download-WinRMConfigScript.ps1
|
||||
Downloads both files to C:\WinRM and interactively prompts for the Zabbix Proxy IP
|
||||
address.
|
||||
|
||||
.EXAMPLE
|
||||
PS> .\Download-WinRMConfigScript.ps1 -ZabbixProxyIPAddress '192.168.10.50'
|
||||
Downloads both files and sets FWWinRMTrustedHosts to 192.168.10.50 without prompting.
|
||||
|
||||
.EXAMPLE
|
||||
PS> .\Download-WinRMConfigScript.ps1 -ZabbixProxyIPAddress '192.168.10.50' -WhatIf
|
||||
Shows what would be downloaded/changed without actually downloading or modifying
|
||||
anything.
|
||||
|
||||
.EXAMPLE
|
||||
PS> irm https://s.tslab.cz/ZBXWinRM | iex
|
||||
Runs the script directly from the repo without saving it locally first, prompting
|
||||
interactively for the Zabbix Proxy IP address. To pass -ZabbixProxyIPAddress in the
|
||||
same one-liner, wrap it as a script block instead:
|
||||
PS> iex "& { $(irm https://s.tslab.cz/ZBXWinRM) } -ZabbixProxyIPAddress '192.168.10.50'"
|
||||
|
||||
.NOTES
|
||||
Author: Petr Štěpán
|
||||
Created: 2026-07-21
|
||||
Version: 1.0.0
|
||||
Changelog:
|
||||
1.0.0 - Initial version
|
||||
#>
|
||||
|
||||
[CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Medium')]
|
||||
param(
|
||||
[Parameter(Mandatory = $false, HelpMessage = 'Zabbix Proxy IP address to allow through the WinRM firewall rule. Leave empty to keep the existing value.')]
|
||||
[string]
|
||||
$ZabbixProxyIPAddress
|
||||
)
|
||||
|
||||
# --- Safety preamble -------------------------------------------------------
|
||||
Set-StrictMode -Version Latest
|
||||
$ErrorActionPreference = 'Stop'
|
||||
|
||||
# Older Windows Server releases don't enable TLS 1.2 by default, which would make the
|
||||
# download below fail silently against a TLS-1.2-only server.
|
||||
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
|
||||
|
||||
$SourceBaseUri = 'https://git.totalservice.cz/PSScripts/WindowsServer/raw/branch/main/ConfigWinRMForZabbix'
|
||||
$DestinationPath = 'C:\WinRM'
|
||||
$ScriptFile = Join-Path -Path $DestinationPath -ChildPath 'ConfigWinRM.ps1'
|
||||
$ConfigFile = Join-Path -Path $DestinationPath -ChildPath 'ConfigWinRM.xml'
|
||||
|
||||
# --- Functions ---------------------------------------------------------
|
||||
|
||||
function Invoke-RemoteFileDownload {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Downloads a single file from a URI to a local path.
|
||||
.PARAMETER Uri
|
||||
Source URI to download from.
|
||||
.PARAMETER OutFile
|
||||
Local destination file path.
|
||||
#>
|
||||
[CmdletBinding(SupportsShouldProcess = $true)]
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[string]
|
||||
$Uri,
|
||||
|
||||
[Parameter(Mandatory = $true)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[string]
|
||||
$OutFile
|
||||
)
|
||||
|
||||
if ($PSCmdlet.ShouldProcess($OutFile, "Download from $Uri")) {
|
||||
try {
|
||||
Invoke-WebRequest -Uri $Uri -OutFile $OutFile -UseBasicParsing
|
||||
Write-Host "Downloaded '$Uri' to '$OutFile'."
|
||||
}
|
||||
catch {
|
||||
Write-Error "Failed to download '$Uri' to '$OutFile': $_"
|
||||
throw
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function Update-WinRMTrustedHostConfig {
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Sets the <FWWinRMTrustedHosts> element of a ConfigWinRM.xml file.
|
||||
.PARAMETER Path
|
||||
Path to the ConfigWinRM.xml file to update.
|
||||
.PARAMETER TrustedHost
|
||||
Value to write into <FWWinRMTrustedHosts>.
|
||||
#>
|
||||
[CmdletBinding(SupportsShouldProcess = $true)]
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[ValidateScript({ Test-Path -Path $_ -PathType Leaf })]
|
||||
[string]
|
||||
$Path,
|
||||
|
||||
[Parameter(Mandatory = $true)]
|
||||
[ValidateNotNullOrEmpty()]
|
||||
[string]
|
||||
$TrustedHost
|
||||
)
|
||||
|
||||
try {
|
||||
# PreserveWhitespace keeps the original file's indentation/comments intact -
|
||||
# without it, XmlDocument.Save() would reformat the whole file.
|
||||
$xml = New-Object -TypeName System.Xml.XmlDocument
|
||||
$xml.PreserveWhitespace = $true
|
||||
$xml.Load($Path)
|
||||
|
||||
$node = $xml.ConfigWinRM.Options.FWWinRMTrustedHosts
|
||||
if ($null -eq $node) {
|
||||
throw "Element <FWWinRMTrustedHosts> was not found in '$Path'."
|
||||
}
|
||||
|
||||
if ($PSCmdlet.ShouldProcess($Path, "Set FWWinRMTrustedHosts to '$TrustedHost'")) {
|
||||
$xml.ConfigWinRM.Options.FWWinRMTrustedHosts = $TrustedHost
|
||||
$xml.Save($Path)
|
||||
Write-Host "FWWinRMTrustedHosts set to '$TrustedHost' in '$Path'."
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-Error "Failed to update '$Path': $_"
|
||||
throw
|
||||
}
|
||||
}
|
||||
|
||||
# --- Main --------------------------------------------------------------
|
||||
try {
|
||||
if (-not (Test-Path -Path $DestinationPath)) {
|
||||
if ($PSCmdlet.ShouldProcess($DestinationPath, 'Create directory')) {
|
||||
New-Item -Path $DestinationPath -ItemType Directory -Force | Out-Null
|
||||
Write-Host "Created directory '$DestinationPath'."
|
||||
}
|
||||
}
|
||||
|
||||
Invoke-RemoteFileDownload -Uri "$SourceBaseUri/ConfigWinRM.ps1" -OutFile $ScriptFile
|
||||
Invoke-RemoteFileDownload -Uri "$SourceBaseUri/ConfigWinRM.xml" -OutFile $ConfigFile
|
||||
|
||||
# Only prompt when the caller did not pass the parameter at all - an explicit empty
|
||||
# string ("") means "skip the prompt, leave ConfigWinRM.xml unchanged".
|
||||
if (-not $PSBoundParameters.ContainsKey('ZabbixProxyIPAddress')) {
|
||||
$ZabbixProxyIPAddress = Read-Host -Prompt 'Enter Zabbix Proxy IP address (press Enter to keep the current value)'
|
||||
}
|
||||
|
||||
if ([string]::IsNullOrWhiteSpace($ZabbixProxyIPAddress)) {
|
||||
Write-Host 'No Zabbix Proxy IP address provided - ConfigWinRM.xml left unchanged.'
|
||||
}
|
||||
else {
|
||||
$parsedIp = $null
|
||||
if (-not [System.Net.IPAddress]::TryParse($ZabbixProxyIPAddress, [ref] $parsedIp)) {
|
||||
throw "'$ZabbixProxyIPAddress' is not a valid IP address."
|
||||
}
|
||||
|
||||
Update-WinRMTrustedHostConfig -Path $ConfigFile -TrustedHost $ZabbixProxyIPAddress
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-Error "Script failed: $_"
|
||||
exit 1
|
||||
}
|
||||
|
||||
exit 0
|
||||
Reference in New Issue
Block a user