PowerShell 跨域远程连接到许多服务器
我是DBA。我正在尝试编写一堆可以从一台中央服务器执行的脚本。理想的情况是将所有脚本从中央服务器发送到跨多个 win 域的 50 多个服务器（用于数据库管理目的）。
我遇到的问题是 - 安全性。看来 PowerShell 远程处理是正确的选择。但是当我将脚本发送到另一台服务器时，我收到“未数字签名”错误。
我可以“自我签名”。但该证书仅在本地计算机上受信任。所以这个选项已经不存在了。
也许证书颁发机构是一条出路。或者添加受信任的主机。我对此一无所知，所以如果您知道任何博客文章或如何做到这一点 - 这将会有很大的帮助。
I am DBA. I am trying to write bunch of scripts that I could execute from one central server. Ideal would be to send all the scripts from central server to say 50+ servers across multiple win domains (for databases management purposes).
The problem I am running into is - security. Seems like PowerShell Remoting is the way to go. But when I send a script to another server, I get 'not digitally signed' error.
I could 'self sign'. But that cert if only trusted on local machine. So that option is out.
Maybe Certificate Authority is a way to go. Or adding trusted hosts. I just have no clue on this one, so if you know any blog posts or how to do this - it would be big help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
嗯，这是一个安全风险，但始终可以将执行策略设置为 RemoteSigned，在每台服务器上保留本地存储库并根据需要通过 PS-Remoting 调用这些存储库。不过我有点不喜欢这个想法。
如果您要进行远程执行，则需要对脚本进行签名。详细的步骤可以参见此处。它甚至包括通过 GPO 部署证书，使其受到域信任。
Well, it's a security risk, but there's always the possibility of setting the execution policy to RemoteSigned, keeping a local repository on each server and calling those as needed via PS-Remoting. I don't like that idea one bit though.
If you are doing remote execution, you will need to sign your scripts. A detailed step by step can be found here. It even covers deploying the cert via GPO so that it's domain trusted.
我会使用 PowerShell 远程处理。这将允许您将其作为远程命令而不是远程脚本运行。如果您了解此内容 SimpleTalk 文章，在“持久会话”之后。它显示了针对每个服务器而不是脚本执行一组命令的选项。这应该可以避免处理远程签名问题并提供更多控制。
远程会话中唯一需要处理的是您的凭据。我没有在多个域上尝试过此操作，而是在一些独立服务器上尝试过。
I would use PowerShell remoting. This would allow you to run it as remote commands instead of remote scripts. If you catch the bottom of this SimpleTalk article, after "Persistent Sessions". It shows the option of executing a set of commands against each server instead of the script. This should prevent having to deal with the remote signed issue and provide a little more control.
The only thing to deal with on remote sessions is your credentials. I have not tried this on multiple domains but a few stand-alone servers.