CNAMES、主机文件和 PowerShell 远程处理

Question

有没有人获得 powershell 远程处理来处理 CNAMES 或主机文件。

一种测试方法，针对本地主机创建一个 PSsession 以确保其工作正常...然后将主机记录指向 127.0.0.1 并调用某个名称，然后尝试针对该记录创建一个 PSsession。

我收到这样的错误

[funkymonkey] Connecting to remote server failed with the following error message : WinRM cannot pr
ocess the request. The following error occured while using Kerberos authentication: The network pat
h was not found.
 Possible causes are:
  -The user name or password specified are invalid.
  -Kerberos is used when no authentication method and no user name are specified.
  -Kerberos accepts domain user names, but not local user names.
  -The Service Principal Name (SPN) for the remote computer name and port does not exist.
  -The client and remote computers are in different domains and there is no trust between the two d
omains.
 After checking for the above issues, try the following:
  -Check the Event Viewer for events related to authentication.
  -Change the authentication method; add the destination computer to the WinRM TrustedHosts configu
ration setting or use HTTPS transport.
 Note that computers in the TrustedHosts list might not be authenticated.
   -For more information about WinRM configuration, run the following command: winrm help config. F
or more information, see the about_Remote_Troubleshooting Help topic.
    + CategoryInfo          : OpenError: (System.Manageme....RemoteRunspace:RemoteRunspace) [], PS
   RemotingTransportException
    + FullyQualifiedErrorId : PSSessionOpenFailed

Answer 1

如果 NTLM 不起作用，我认为您会受到 Winsrv 2003 sp1+ 中添加的环回检查内容的影响。您可以将 CNAME 添加到特殊的注册表项，该注册表项会将它们包含在例外列表中（已包含 localhost）

。新项目 hklm:\system\currentcontrolset\control\Lsa\MSV1_0
返回连接主机名 `
-propertyType multistring -val "cname1","cname1.local"

有些人只是通过设置双字DisableLoopbackCheck（谷歌它）来完全关闭它（环回检查），但你真的应该用前一种方法更严格地控​​制它，而不是采取懒惰路线。

IIRC，此安全功能可防止一种称为“反射攻击”的特定类型的凭证盗窃。我不记得方法了，但我相信你可以在网上找到它。