jborean93
commented
2 years ago The crux of the issue with omi is that it is super inefficient which is compounded by the fact that for every single HTTP request it will re-authenticate rather than trying to re-use the socket/session. This is bad because WinRM is quite a chatty protocol, to just run one command you have the following that needs to be sent:
- Shell creation
- Receive request for shell
- Command creation
- Receive request for command
- Signal command is done
- Shell removal
Depending on how long the shell/command is open it could be sending multiple receive requests after a set amount of time. If the command is large then it can also send them in multiple messages. Each one of the requests from the client is re-authenticating by attaching a new Kerberos token which means it needs to;
- lookup the KDC
- optionally authenticate itself with the password if a password is set
- ask the KDC for a ticket to the server
The lookup phase can be quite inefficient if DNS is used and is not set up in a way to make that easily done. This essentially means if any of the stages to build the HTTP request; kerb, DNS, network latency, is slow it is compounded quite dramatically and creates a slow session that you are seeing.
So to try and speed things up I recommend you:
- Hardcode the KDC server in the krb5.conf
[libdefaults]
# I'm not sure if this is actually needed or whether the manual mapping
# below is enough
dns_lookup_kdc = false
[realms]
DOMAIN.COM = {
kdc = dc.domain.com
}
[domain_realm]
.domain.com = DOMAIN.COM
domain.com = DOMAIN.COM- Before connecting use
kinit username@DOMAIN.COMand thenEnter-PSSession/Invoke-Commandwithout any explicit credential
The 2nd step isn't usually too bad but can be a source of potential slowdowns. I'm not sure about the TCP side as I've never encountered it before. Potentially the krb5 token is just too large and needs to use TCP.
This should remove any ambiguity and remove the DNS lookups that happen at runtime. You can also set dns_lookup_kdc = false in [libdefaults] to disable the DNS lookup altogether.
While I would love to fix up omi to be more efficient and re-use a socket/session to avoid all these re-authentication requests this is not a trivial task as it would require the whole library to be re-worked. I prefer to just rewrite the WSMan client in C# for PowerShell to use. I've actually started on this task but I can only work on it in my spare time so it is slow going. The actual WSMan bits are done, the tricky part is getting it to work in PowerShell without changes on its end.
Yannik
Hi @jborean93,
first of all, thank you so much for taking on this project! I'm really glad I found it, because I've always had to use a VM to work on windows servers, but with this, that could be a thing of the past.
Unfortunately, I have been having some troubles: The execution of command is really really slow. A simple
Write-Host Helloon a remote windows server takes about 5 seconds. Working interactively like this is pretty much impossible.I have tried extensively to debug and resolve this problem.
The test environment
First of all, to make this as reproducable as possible, I have built a test environment in docker like this:
docker run -it debian:bullseye /bin/bashsudo pwsh -Command 'Install-Module PSWSMan -confirm:$false -Force' sudo pwsh -Command 'Install-WSMan'
echo ' [realms] DOMAIN.COM = { kdc = dc1.domain.com admin_server = dc1.domain.com } [domain_realm] .domain.com = DOMAIN.COM ' > /etc/krb5.conf
Enter-PSSession -Credential (Get-Credential) dc1.domain.com -Authentication Kerberos