WinRM & Secure Shell

What is WinRM Microsoft's implementation of?

the WS-Management protocol

What does WinRM allow systems to exchange and access across a network?

management information

What type of program is WinRM?

a Simple Object Access Protocol (SOAP) based program

What connections does WinRM rely on to communicate between systems?

HTTP/HTTPS connections

What can the administrator use the WinRM console to do remotely?

execute management commands on the system

What do all current versions of Windows already include?

the WinRM application

What is one use of WinRM for log collection and analysis?

forward logs to a remote system

What security concern exists with the use of WinRM?

remote attackers can execute their own commands against the network device

Why are concerns about clear text traffic when using HTTP unfounded with WinRM?

WinRM utilizes Kerberos to encrypt the traffic before passing it through the HTTP connection

What encrypts WinRM traffic before it passes through the HTTP connection?

Kerberos

What does SSH stand for?

Secure Shell

What does Secure shell connect to rather than a desktop window manager?

a command interpreter

What TCP port does SSH use by default?

TCP port 22

What does SSH use to protect each session?

encryption

What identifies each SSH server's public/private encryption key pair?

a host key fingerprint

What do clients use the host key fingerprint to verify?

that they are attempting to connect to a trusted server

What risk does verifying the host key fingerprint mitigate?

on-path attacks

How can a mapping of host names to SSH server keys be kept?

manually by each SSH client or with enterprise software products designed for SSH key management

What is the server's host key pair used to set up?

an encrypted channel

What can the client submit securely through the encrypted channel?

authentication credentials

What are two commonly implemented SSH client authentication methods?

password authentication and public key authentication

In password authentication, what does the client submit?

a username and password

In public key authentication, what must the client use to decrypt the challenge and complete authentication?

the matching private key it holds

What is a critical security task for SSH public keys?

monitoring for and removing compromised client public keys

What have many recent attacks on web servers exploited?

poor SSH key management