groot

Hi support team

I'm trying to test out the new LAPS credential entry (using LAPS legacy) as mentioned in the latest "whats new" for version 2024.2.15.0 64-bit (enterprise)

It's not at all clear what information to specify in the properties of the entry. I've tried various combinations but cannot see where to enter a Hostname for LAPS to lookup, nor get it to prompt for a Hostname?

I also created an RDP entry to reference this credential entry, but it doesn't seem to attempt to use LAPS?

Any documentation or assistance would be appreciated!

Thanks

Thanks for the insight Marc-André

Our use case is primarily for internal network segmentation, so that management interface access is restricted to a small set of machines - we already have a SASE solution in place for remote connectivity, along with a remote desktop/gateway type solution for staff access, so the Devolutions Gateway would be a large overlap in functionality and not really fit our environment.

In terms of connections - we are using the typical administrator types - web consoles, SSH/telnet, RDP

Regards

Thanks Samuel

It would be preferable not to have an extra click to select a jump host if the default host is available.

If the default jump host were not available, providing a selector to choose an alternate would work.

It has occurred to me that another reason for pooling jump hosts would be for load balancing - I realise this is not currently possible, but would be a great feature to have available.

Regards

Hi, we are interested in using the jump feature, which we have tested successfully with a single jump host.

Our concern is that this concentrates all admin connectivity via a single point of failure - the jump host. In an emergency situation this could be extremely problematic.

Is it possible to create a pool of jump hosts, so that if one is unavailable, another in the pool will be automatically chosen?

Thanks

Is there any update on this? We have also moved our DB to Azure SQL, with Azure MFA

All the users are configured as users on the database (but not the server), but we're unable to connect.

• edit to say I know you mentioned waiting for .net updates, but other PS modules can use Azure MFA TOTP via text input, is this not something you can look into?

thanks

Aaron

Hello,

If you have MFA enabled to connect to your SQL instance, you will need to enter the passcode to be able to establish the connection.

I was able to replicate your issue with retrieving the username of a session in the private vault, I will open an internal ticket to the engineering team and will keep you updated.

Best regards,

Thankyou!

Additionally, we get the same Access Denied message when using Get-RDMSessionPassword from the private vault. I haven't actually got as far as testing/requesting any info from the main vault yet.

Hi Richard

Sorry to be digging up an old thread - we had to put a workaround in place with manual credential entries etc due to the issue above, and am only now getting back to this now that we're going into a quiet period.

We're obviously now on a later release of both the PS Module (2021.2.0.34) and the RDM Client (2021.2.27.0 64-BIT)

I now see that the connection is requesting a key - I have tried entering the OTP code, however I suspect this isn't what it's looking for? We are connecting to an onprem SQL data source with MFA configured.

As you can see the connection seems to be ok, but whenever I try to get details from a Session entry, I get access denied.

Hi, still no luck I'm afraid. The old module doesn't import, even with the new module removed and powershell restarted. Tried both as user and administrator with the same result.

PS C:\Windows\system32> cd C:\temp\Devolutions.RemoteDesktopManager.Bin.2021.1.44.0\
PS C:\temp\Devolutions.RemoteDesktopManager.Bin.2021.1.44.0> Import-Module .\RemoteDesktopManager.PowerShellModule.psd1

Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run
C:\temp\Devolutions.RemoteDesktopManager.Bin.2021.1.44.0\RemoteDesktopManager.PowerShellModule.dll-Format.ps1xml?
[D] Do not run  [R] Run once  [S] Suspend  [?] Help (default is "D"): r
Import-Module : Could not load file or assembly
'file:///C:\temp\Devolutions.RemoteDesktopManager.Bin.2021.1.44.0\RemoteDesktopManager.PowerShellModule.dll' or one of
its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)
At line:1 char:1
+ Import-Module .\RemoteDesktopManager.PowerShellModule.psd1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Import-Module], FileLoadException
    + FullyQualifiedErrorId : System.IO.FileLoadException,Microsoft.PowerShell.Commands.ImportModuleCommand

When I try to install the older version it simply says that a newer version is already installed, and I have no option to continue.

If I download the binary package and try to import the module from there, I get the following:

Import-Module : Could not load file or assembly 'file:///C:\temp\Devolutions.RemoteDesktopManager.Bin.2021.1.44.0\RemoteDesktopManager.PowerShellModule.dll' or one of its
dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)
At line:1 char:1
+ Import-Module .\RemoteDesktopManager.PowerShellModule.psd1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Import-Module], FileLoadException
    + FullyQualifiedErrorId : System.IO.FileLoadException,Microsoft.PowerShell.Commands.ImportModuleCommand

I have also tried adding the extracted path to $env:path, but that doesn't help at all, same message as above.

I can't remove the latest version and install the older one, as the database has been upgraded.

Please assist! Do I need to log a support ticket?

Hi Team

This is extremely infuriating. We have business critical processes which rely on being able to access information in our RDM database, and judging by comments in this forum you appear to have updated the product without full testing and without allowing any rollback to a previous version of the module.

I have downloaded the new module from the psgallery.

C:\> Get-Module -ListAvailable -Name "RemoteDesktopManager" | ft -auto


    Directory: C:\Users\user\Documents\WindowsPowerShell\Modules


ModuleType Version     Name                 ExportedCommands
---------- -------     ----                 ----------------
Binary     2021.2.0.24 RemoteDesktopManager {Add-RDMRoleRepositoryAccess, Add-RDMRoleToUser, Add-RDMSessionAttachment, Add-RDMUserRepositoryAccess...}

C:\> Get-RDMDataSource -Name "-SQLCluster"
Unable to connect to the data source.
Do you want to go in offline mode?
[] Yes  [] No  [?] Help NotImplementedException - The method or operation is not implemented.

   at RemoteDesktopManager.UIService.set_MessageShown(Boolean value)
   at Devolutions.RemoteDesktopManager.Business.GoogleAuthenticatorTwoFactorDescriptor.Validate(String token, String accountName)
   at Devolutions.RemoteDesktopManager.Business.DataSources.BaseConnectionDataSource.UnlockTwoFactor(Boolean ignoreTwoFactorChecked)
   at Devolutions.RemoteDesktopManager.Managers.LockManager.EnsureDataSourceUnlockedTwoFactor(BaseConnectionDataSource dataSource)
   at Devolutions.RemoteDesktopManager.Managers.ConnectionManager.LoadConnectionsFromDataSource(ConnectionEngine engine, Boolean hasChanged)
   at Devolutions.RemoteDesktopManager.Managers.ConnectionManager.LoadConnections(BaseConnectionDataSource dataSource)

Our datasource is protected using MFA - in the past this command would present the MFA prompt to allow the script to connect.

While you develop a fix for this, please can I have access to the previous version of the module? Is there an old version of the RDM download I can access?

Thanks

Thankyou, tested with 2020.2.17.0 and all working as expected again :)

We seem to have recently seen an annoying behaviour change with certain entry types, whereby they don’t use the credentials specified, and instead ignore them and just use the current user creds.

Namely this is happening with powershell and CMD entries. RDP and websites seem to respect the credentials specified.

For example, no matter what I configure in this CMD entry, the process launches with my logged on user cred. It doesn’t matter if the credentials specified are private vault, embedded etc, they are simply ignored.

This is super frustrating as we use these entries to launch admin consoles like dsa.msc etc, and now they’re launching without rights.

Tested with versions 2020.2.14.0 and 2020.2.15.0

Hi Erica

Thankyou for the reply.

If the credentials are stored in clear text in environment variables, this seems to be a security by obscurity measure - to be honest I don't know why we would bother adding this layer of complexity, when the credentials are already obscured/encoded in the config file.

Being hidden in the config file would mean an attacker would need to have indepth knowledge of RDM, as opposed to being called from env variables where an attacker would only need basic scripting knowledge. It seems like the RDM obscurity is better.

Is there no better way to do this? Perhaps I should look at storing the RDM credentials in an Azure key vault which would at least give me a proper API key which I can rotate and restrict?

Thanks

Can anyone assist with the above?

Thanks heaps

Thankyou for the fast response

I have sucessfully completed the following:

On the core server:

Extracted the RDM client zip file

Configured the alternate config location

On a full GUI client:

Setup a new SQL database connection using a SQL credential, with the username and password saved (not sure if this is the best way to achieve my goal, as below).

Copied the config file to the server

On the server:

Imported the RDM PS module

Successfully retrieved a credential from the database (yay!)

So, my next question is (and pertaining to point (b) in the original post) - how do I secure this setup for use in automation?

As I understand it, the config file could be picked up and used on any machine.

I can't prompt for a password when the script runs as that means it's not automated

I obviously don't want to hardcode a password in a script

For example, with my previous password vault I could limit an API key to a particular IP address, which meant even if the API key was acquired it couldn't be used anywhere else.

What would the most secure way to achieve this automation be?

Thanks

Hi

I have the following scenario and I would like to know if (a) it's even possible, and if so (b) what is the most secure way to do this

Environment:

DSC Server: Windows Server 2016 core

RDM database: SQL 2016 SP1 (mixed auth)

RDM Version: Enterprise ( latest)

From the DSC server (note - server core/no gui) I want to be able to run a script which connects to the RDM datasource and retrieves passwords for various service accounts. The DSC side of things works fine, and I already have scripts connecting to our legacy password vault via API calls.

I am aware there is a zip package for the RDM client installation which I can extract and use to retrieve and import the RDM PS module, however where do I go from here?

It seems like the set-datasource command expects an already configured datasource within RDM but obviously I can't open the GUI and to this on server core. Is there a config file I need to setup/create to do this?

Even if I do get a datasource connected, given this will ultimately want to run automated, what is the most secure way to access the datasource so that I'm not hard-coding credentials in scripts? For example in my legacy (non RDM) password vault I'm able to create an API key which is only usable from the DSC server's IP, and only has access to a specific credential entry.

Hope this makes sense, look forward to hearing what can be done.

Thanks

Hi

Please excuse what might be a n00b question, but what is the process for setting up web connections where the login is paginated - ie username on the first page, password on the next?

For example, AWS, and many Microsoft services.

Thanks