gmaclellan

There's two feature requests I have relating to this:

1) Create a credentials entry where you can simply specify a profilename, and have it load the actual key and secret out of the existing credentials file (either SDK or plain credentials file would work). This avoids having to have the keys stored in multiple places.

2) Allow using these credential entries with the other AWS entries (Console, S3 explorer)

Great to hear! Thanks.

I am trying to import an XML datasource using powershell. From reading the docs (https://help.remotedesktopmanager.com/index.html?new-rdmdatasource.htm), it seems like I should be able to do:

C:\> Import-Module -Name "${env:ProgramFiles(x86)}\Devolutions\Remote Desktop Manager\RemoteDesktopManager.PowerShellModule.psd1"

C:\> $s = New-RDMDataSource -XML -FileName c:\path\to\test1.xml -Name test1

C:\> Set-RDMDataSource -DataSource $s

This doesn't have an output or indicate any errors, but it also doesn't work.

It looks like the output from New-RDMDataSource is ok:

C:\> $s

ID Name Type

-- ---- ----

0e773a8c-0483-4a61-a797-3a226d62dffd test1 Xml

However, after using Set-RDMDataSource (even if I use Update-RDMUI or restart RDM), this new entry doesn't show up in the UI or the output of Get-RDMDataSource.

I also tried this with the -SetDatasource, with no success.

How do I add a new XML datasource from powershell? (Or just automate it, somehow)

@David Yes, that would be perfect!

Separately, it would be nice if it'd support PEM format keys and automatically convert (even when importing from the UI) as AWS in particular exports PEM keys, and this would let you import them directly to RDM, without having to manually convert via puttygen or whatever first.

I'm trying to automate importing instances from AWS, and wanted to distribute a single XML file (and potentially generate it/host it from a web server with its own security controls). Right now I have to distribute either the app to generate the xml or the xml file (haven't decided yet) PLUS all the certificates necessary.

I did look at the EC2 Synchronizer, but it doesn't look like it works for this:

• There are three ways of accessing instances, depending on use and age of setup: public IP (some test systems), private IP via router-established VPN (older setup), private IP tunneled through a bastionhost (newer setup). There's custom logic to determine which method to use.

• I am planning on adding tunnels to SQL server and MySQL as well, when detected, for both RDS and EC2-hosted databases. These would also go via VPN/bastionhost with the same logic (none of those are public)

• We have the same VPC name deployed to multiple regions, and my app sorts this into folders like VPC>Region>system. I can't see how to do this with Ec2 Sync (in fact, I couldn't get it to use groups at all, but that's aside)

• Depending on use we sometimes use a combination of name/instanceid/privateip to identify systems, so I was trying to concisely name them, and came up with eg ("SomeApp-backend (i123..546, 10.42.1.52)"). I don't think this can be done with EC2 sync

Were you able to successfully use that key?

I also tried the same thing with 14.1.3.0, here's what I found:

• The import appears to work, and it creates the key entry

• I can't connect to anything using the imported file

• When I Edit the entry it shows "Private key previously saved..." but when I click the view button, nothing happens

• If I press OK to save it, the XML file is updated and the <SafePrivateKeyData> element is removed entirely

So it seems to me like it's silently ignoring the data in this element, presumably when it's not encrypted in the right format.

Here's what I'm importing:

<Connection>

<Credentials>

<CredentialType>PrivateKey</CredentialType>

<PrivateKeyType>Data</PrivateKeyType>

<SafePrivateKeyData>PuTTY-User-Key-File-2: ssh-rsa

Encryption: none

Comment: rsa-key-20190205

Public-Lines: 6

AAAAB3NzaC1yc2EAAAABJQAAAQEApu8xH5K3AO0MDyKBUikPZVVXn9l5Vyui8z/1

rUtYthkLVr5Abu3gP2LOEdA/FTBY3QMZF9FmyNL8Fu+qGdf0+l4Ftve3fNxaWVF3

6om6vsX5NHNN3F2/iudUIqrkWj6kxvRlhCoGDVh1NAq8WLl9wN5+l3tdGIhKoRx/

XbUb/wpoaljR3m0pLQGlHrEUaZkbutCsaiBc8yigWLUvGH+tUWtetN6HVKfV1f8J

R1FXA3RVljnoM0tKV36WN+50RHdvsunta8rZoSJueU0KU6T8NVup78HvsI4zqAin

JLkOVdzDoMuRR9qBHHeQ1kKVsKSuG0e2fpfHONREbT03cv1n/Q==

Private-Lines: 14

AAABAQCd6S53z/k4Oi4AepYBnHZY791ELpVgS99Uzcy4rw66F7DHrQyEm9QgSLUX

xP1nEg7e50FAC0WNiU9T93dkjgNpX9vkbck+wpqnhGqD6hGEB2FbIPagBadZ4b5K

TqCoZMViQSHCNZcFtIqLLMAA5tDm4E48RENOjsMix+4aXzYomZf2rgY9lhR25eaS

WRE1EzNA+Qs1J5t+TwekiGs0SiKMLtp41a525dU035CfTHHm7gD01uE4fAPuMJk/

E8kFUN8YXrnFLtWXlGQ5IWayvn/x4+C9fl0lDfZrlLrVYHnZRY1B/MY/s20IZOJh

BQr3SRgKYogcatI4zhTnNiz+fvARAAAAgQD0L5CSSjE0Pxxmw7H06Gt1avM7uudh

UWDsALqVBsyNaZFt9FtKGNDgQrA+dnEW6ce8L27L1QDlsBJiQ9wwSkoiXmdVE0ot

MsAUvVle/mDHkx7DPoMktzBUJC1P0Fsa33XwpwBZDQHE2SDz0hOlILAW+3QPs2dH

dZAbw/+u3JAbvwAAAIEArwLOc38Ds2jjk8BJMeKro1RSghfx2ukNwjUD/NpsEVOo

aOGv+dQXMXFbI00Lx7CFHAwxGFXHSo5dZhB5sUxUJvjrQayfnr+DpqQg0Q1WP6nW

+Rwfm7TwBuY+HMqRj+h8YjexX1aXZkHHZI79uRWCv4nghJ6FDz4Sh5ePO8PnG0MA

AACBAO59SwtJO6SXc60crJmHVNo6QP5pBRXfr2esO1fUBWIPAq8q+D0Bs0CmzM7j

iC61VkGD8/knoQkxkhGSgXdTNdoIUFI3nC0b35LXUNGBuO+uqGr/dTWnRFTGUnUB

NTn0E3u7xDL30NebY6VdWTNnMkF6Ny7qdyuiFvRhAYzI8ht0

Private-MAC: 9e44de96036941cb97432251fa2002f1423cfd43</SafePrivateKeyData>

</Credentials>

<ConnectionType>Credential</ConnectionType>

<CreatedBy>Import</CreatedBy>

<CreationDateTime>2019-02-07T02:01:37</CreationDateTime>

<Group>Test</Group>

<ID>e4286ade-4dbf-4099-be0e-df50d5631bb6</ID>

<Name>Test key</Name>

</Connection>

(Note this particular key is a fake one I just generated for the purposes of this test)

If I edit the entry using the RDM UI, and paste the exact key contents in (which I had between the SafeImportKey), everything works fine.

Actually, I just came up with a usable (though awkward) workaround:

$Result.Password = (powershell.exe -Command "Get-EC2PasswordData -InstanceId i-0123456789 -PemFile $env:USERPROFILE\.aws\MyKey.pem")

I'm trying to dynamically obtain the password for an AWS EC2 instance using the Get-EC2PasswordData powershell cmdlet. I have

$Result.Username = "administrator"

$Result.Domain = ""

$Result.Password = Get-EC2PasswordData -InstanceId i-0123456789 -PemFile $env:USERPROFILE\.aws\MyKey.pem

Running this via powershell session works fine, however, when I even try to save this entry, I get:

Could not load type 'Amazon.Runtime.CredentialManagement.CredentialProfileStoreChain' from assembly 'AWSSDK.Core, Version=3.3.0.0, Culture=neutral, PublicKeyToken=885c28607f98e604'.

At line:13 char:20

+ ... .Password = Get-EC2PasswordData -InstanceId i-0123456789 -PemFile $en ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo: NotSpecified: (:) [Get-EC2PasswordData], TypeLoadException

I have AWS PowerShell 3.3.428.0 installed. I added GET-AWSPowerShellVersion to my credentials script (the output from it is included in the error dialog) and it shows the same.

I also noticed that when RemoteDesktopManager.exe starts up, there are many assembly binding errors for AWSSDK items (via fuslogvw):

These all look the same:

*** Assembly Binder Log Entry (2/6/2019 @ 9:01:15 PM) ***

The operation failed.

Bind result: hr = 0x80070002. The system cannot find the file specified.

Assembly manager loaded from: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll

Running under executable C:\Program Files (x86)\Devolutions\Remote Desktop Manager\RemoteDesktopManager.exe

--- A detailed error log follows.

=== Pre-bind state information ===

LOG: DisplayName = AWSSDK.SecretsManager

(Partial)

WRN: Partial binding information was supplied for an assembly:

WRN: Assembly Name: AWSSDK.SecretsManager | Domain ID: 1

WRN: A partial bind occurs when only part of the assembly display name is provided.

WRN: This might result in the binder loading an incorrect assembly.

WRN: It is recommended to provide a fully specified textual identity for the assembly,

WRN: that consists of the simple name, version, culture, and public key token.

WRN: See whitepaper http://go.microsoft.com/fwlink/?LinkId=109270 for more information and common solutions to this issue.

LOG: Appbase = file:///C:/Program Files (x86)/Devolutions/Remote Desktop Manager/

LOG: Initial PrivatePath = NULL

LOG: Dynamic Base = NULL

LOG: Cache Base = NULL

LOG: AppName = RemoteDesktopManager.exe

Calling assembly : System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35.

===

LOG: This bind starts in default load context.

LOG: Using application configuration file: C:\Program Files (x86)\Devolutions\Remote Desktop Manager\RemoteDesktopManager.exe.Config

LOG: Using host configuration file:

LOG: Using machine configuration file from C:\Windows\Microsoft.NET\Framework\v4.0.30319\config\machine.config.

LOG: Policy not being applied to reference at this time (private, custom, partial, or location-based assembly bind).

LOG: Attempting download of new URL file:///C:/Program Files (x86)/Devolutions/Remote Desktop Manager/AWSSDK.SecretsManager.DLL.

LOG: Attempting download of new URL file:///C:/Program Files (x86)/Devolutions/Remote Desktop Manager/AWSSDK.SecretsManager/AWSSDK.SecretsManager.DLL.

LOG: Attempting download of new URL file:///C:/Program Files (x86)/Devolutions/Remote Desktop Manager/AWSSDK.SecretsManager.EXE.

LOG: Attempting download of new URL file:///C:/Program Files (x86)/Devolutions/Remote Desktop Manager/AWSSDK.SecretsManager/AWSSDK.SecretsManager.EXE.

LOG: All probing URLs attempted and failed.

I also noticed Remote DesktopManager ships with AWSSDK 3.3.8.0 dlls (Core, EC2 and S3), and I suspect this is probably related.

Is there a way I can run Get-EC2PasswordData for a custom credentials script? Or another workaround that would let me do this?

Is there a way to define private key data in the XML file for import?

When exported, the file only includes <SafePrivateKeyData>

There's another post that mentions using <ClearTextPassword> (https://forum.devolutions.net/topic17796-import-password-via-xml.aspx) so I tried also ClearTextPrivareKeyData, but it doesn't seem to do anything (defined in <Credentials> or in the <Connection> object).

I'm doing some work on generating an XML import file, but am curious about the ID fields. I want to periodically regenerate the XML file (just overwrite -- without importing the potential changes a user has done).

Each connection has an ID (GUID), and this is used for links between entries (eg: an SSHShell entry referring to a Credential entry for the private key).

When I regenerate the file, should I try to keep the same ID for each entry, or is it fine to just make a new random one each time? (Basically, is referenced anywhere else besides just the file?)

Each connection also have a stamp GUID but I'm not really sure what it's for. From experimentation, I noticed that if I leave it off, after import RDM modifies the file and adds a Stamp value to every entry. I also noticed if I modify the entry in the RDM interface, a new stamp value is generated.

What is 'stamp' used for? Am I safe to just assign a random GUID, or should I leave it off, or something else?

Aside, is there any documentation on the XML format itself available somewhere?