Powershell and CredSSP in Production Environments

Question

I try deploy Sharepoint WSP projects using PowerShell Remoting.

See PowerShell Remoting Sharepoint 2010 Error

Solution is configure CredSSP for Sharepoint.

But Microsoft says:

Caution: Credential Security Service Provider (CredSSP) authentication, in which the user's credentials are passed to a remote computer to be authenticated, is designed for commands that require authentication on more than one resource, such as accessing a remote network share. This mechanism increases the security risk of the remote operation. If the remote computer is compromised, the credentials that are passed to it can be used to control the network session.

Ref: http://technet.microsoft.com/en-us/library/dd347668.aspx

Not recommended in production environments.

Any suggestions for deploy using powershell remoting and sharepoint ?

Answer 1

I only know of 2 methods for PowerShell Remoting in SharePoint 2010. You need to enable PSRemoting and CredSSP on both the client and server for these to happen. CredSSP is a requirement because there since SharePoint cmdlets call SQL, there will be a double hop.

1) Connect to the SharePoint server and essentially execute remote commands on the sp10 server itself.

# Only need to do this part for initial setup for storage of username and pwd and to turn on the Powershell remoting feature
Enable-PSRemoting
Enable-WSManCredSSP -Role client -DelegateComputer *
Read-Host -AsSecureString | ConvertFrom-SecureString | out-file C:\crd-sharepoint.txt 
#Type Password Here 
#This needs to be executed before you can connect to the SharePoint farm/cmdlets
$pwd = Get-Content C:\crd-sharepoint.txt | ConvertTo-SecureString
$crd = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "domain\username",$pwd
Enter-PSSession -ComputerName servername -Authentication CredSSP -Credential $crd
Add-PSSnapin Microsoft.SharePoint.Powershell

2) This will import all SharePoint 2010 Powershell Commands into a local session (Powershell Implicit Remoting).

# If you want to save credentials for an account (credentials need to be specified using CredSSP Auth). Only need to run once
Read-Host -AsSecureString | ConvertFrom-SecureString | out-file C:\crd-sharepoint.txt 
# Type Password Here 
# You could add this to a logon script to automatically import the sharepoint powershell commands into your session
$pwd = Get-Content C:\crd-sharepoint.txt | ConvertTo-SecureString
$crd = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "domain\username",$pwd
$session = New-PSSession servername -Authentication CredSSP -Credential $crd  
Invoke-command $session {Add-PSSnapin Microsoft.SharePoint.Powershell}
Import-pssession -session $session

#This takes a minute or so to spin up so you could save it to disk. This will NEED to be ran before running import-pssession
Export-PSSession -Session $session -OutputModule "SP2010" -CommandName *-SP*

#Import Saved file from disk
Import-Module SP2010