Invoke-PowerShellServer Cmdlet

Parameters   Output Objects   Config Settings  

The Invoke-PowerShellServer Component is used to remotely execute a command on the PowerShell Server.

Syntax

Invoke-PowerShellServer [parameters]

Remarks

This cmdlet uses SSH to invoke a remote command on the PowerShell session hosted by the remote PowerShell Server. Using the cmdlet is very simple. The command is specified by the Command parameter. The command is executed on the remote shell, and the resulting objects are serialized and sent back to the client. PSObject instances with matching fields are reconstructed locally and then returned by the Invoke-PowerShellServerExpression cmdlet.

The cmdlets support pipeline input for some of their parameters. Prebuilding an object and piping it to the cmdlet is very useful, but should be used with caution to prevent security conflicts. Steps have been taken to decrease the risk of a possibly accidental pipe to the cmdlet, for instance, the Credential parameter cannot be piped to the cmdlet and must be specified manually.

# create an SSH connection and store the connection object in a shell variable $conn = Connect-PowerShellServer -server SERVER -cred $mycred #invoke a command on the remote connection Invoke-PowerShellServer $conn -command ls

Connection Handling

This cmdlet supports persistent connections through the Connection parameter. To establish a new PowerShellServer connection, use the Connect-PowerShellServer cmdlet. To close the connection, use the Disconnect-PowerShellServer cmdlet.

Parameter List

---

The following is the full list of the parameters of the cmdlet with short descriptions. Click on the links for further details.

Connection	An already established connection.
LogFile	The location of a file to which debug information is written.
AuthMode	The type of authentication used by the component.
CertPassword	The password to the certificate store.
CertStore	The name of the certificate store for the client certificate.
CertStoreType	The type of certificate store for the client certificate.
CertSubject	The subject of the certificate used for client authentication.
Command	The command to send to the remote SSH Server.
CompressionAlgorithms	A comma-separated list containing all allowable compression algorithms.
Config	Specifies one or more configuration settings.
Credential	The PSCredential object to use for user/password authentication.
EncryptionAlgorithms	A comma-separated list containing all allowable compression algorithms.
FirewallHost	Name or IP address of firewall.
FirewallPassword	A password if authentication is to be used when connecting through the firewall.
FirewallPort	The port of the firewall to which to connect.
FirewallType	Determines the type of firewall to connect through.
FirewallUser	A user name if authentication is to be used connecting through a firewall.
Force	Forces the component to accept the default behavior instead of querying the user.
LocalIP	The IP address of the local interface to use.
LogFile	The location of a file to which debug information is written.
Password	The password to use for authentication.
Port	The port to be used.
Server	The address of the Server.
SSHAccept	The hex-encoded fingerprint of the host to trust explicitly.
Timeout	The maximum time allowed for the operation.
User	The username to use for authentication.

Output Objects

---

The following is the full list of the output objects returned by the cmdlet with short descriptions. Click on the links for further details.

SSHOutput	The PSObject object returned by the Invoke-PowerShellServerExpression Component will have properties matching those of the original object in the remote machine.

Config Settings

---

The following is a list of config settings for the cmdlet with short descriptions. Click on the links for further details.

GSSAPIMechanisms	The desired GSS-API authentication mechanism.
KerberosDelegation	If true, asks for credentials with delegation enabled during authentication.
KerberosRealm	The fully qualified domain name of the Kerberos Realm to use for GSSAPI authentication.
KerberosSPN	The Kerberos Service Principal Name of the SSH host.
BuildInfo	Information about the product's build.
CodePage	The system code page used for Unicode to Multibyte translations.
LicenseInfo	Information about the current license.
MaskSensitive	Whether sensitive data is masked in log messages.
UseInternalSecurityAPI	Tells the component whether or not to use the system security libraries or an internal implementation.

LogFile Parameter (Invoke-PowerShellServer Cmdlet)

The location of a file to which debug information is written.

Syntax

Invoke-PowerShellServer -LogFile string

Remarks

When specified, the cmdlet will log debug information to the file. If the file exists, the information will be appended.

Default Value

null

Connection Parameter (Invoke-PowerShellServer Cmdlet)

An existing PowerShellServer connection.

Syntax

Invoke-PowerShellServer -Connection PowerShellServerConnection

Remarks

Represents an existing, persistent PowerShellServer connection to be used. After this cmdlet executes, the connection will remain opened to be used in an another call. New connections can be established using the Connect-PowerShellServer cmdlet and closed using the Disconnect-PowerShellServer cmdlet.

Default Value

null

AuthMode Property (Invoke-PowerShellServer Cmdlet)

The type of authentication used by the component.

Syntax

Invoke-PowerShellServer -AuthMode string

Remarks

Normally, the cmdlet will attempt to log in to the SSH server and authenticate via username and password. This behavior can be changed to use client key (RSA) authentication by setting this parameter to 'PublicKey'.

Default Value

2

CertPassword Property (Invoke-PowerShellServer Cmdlet)

The password to the certificate store.

Syntax

Invoke-PowerShellServer -CertPassword string

Remarks

Specifies a password (if required) to access the specified certificate store.

Default Value

""

Parameter Alias

CertificatePassword

CertStore Property (Invoke-PowerShellServer Cmdlet)

The name of the certificate store for the client certificate.

Syntax

Invoke-PowerShellServer -CertStore string

Remarks

The CertStoreType parameter specifies the type of the certificate store specified by CertStore. If the store is password protected, specify the password in CertPassword.

CertStore is used in conjunction with the CertSubject parameter in order to specify client certificates. If CertStore has a value, and CertSubject has been set, a search for a certificate is initiated during logon. Please refer to the CertSubject parameter for details.

Designations of certificate stores are platform-dependent.

The following are designations of the most common User and Machine certificate stores in Windows:

When the certificate store type is PFXFile, this parameter must be set to the name of the file.

Default Value

"MY"

Parameter Alias

CertificateStore

CertStoreType Property (Invoke-PowerShellServer Cmdlet)

The type of certificate store for the client certificate.

Syntax

Invoke-PowerShellServer -CertStoreType string

Remarks

This parameter can take one of the following values:

Default Value

0

CertSubject Property (Invoke-PowerShellServer Cmdlet)

The subject of the certificate used for client authentication.

Syntax

Invoke-PowerShellServer -CertSubject string

Remarks

During the user authentication phase of the logon process, the cmdlet will search the store specified in CertStore for a certificate that matches this parameter. If the store contains a private key for that certificate, it is used to verify the user's identity with the secure server.

When this parameter is set, a search is performed in the current certificate store certificate with matching subject.

If an exact match is not found, the store is searched for subjects containing the value of the parameter.

When setting the parameter to a partial subject, CN= should be omitted. For example, the following code would find the certificate with subject CN=Test Certificate, OU=People, C=US

Example (Searching with partial subject)

-certsubject "Test"

If a match is not found, the parameter is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

Default Value

"*"

Command Property (Invoke-PowerShellServer Cmdlet)

The command to send to the remote SSH Server.

Syntax

Invoke-PowerShellServer -Command string

Remarks

The command will be sent to the remote SSH Server.

Default Value

""

Parameter Position

1

This is a required parameter.

CompressionAlgorithms Property (Invoke-PowerShellServer Cmdlet)

A comma-separated list containing all allowable compression algorithms.

Syntax

Invoke-PowerShellServer -CompressionAlgorithms string

Remarks

During the SSH handshake, this list will be used to negotiate the compression algorithm to be used between the client and server. This list is used for both directions: client to server and server to client. When negotiating algorithms, each side sends a list of all algorithms it supports or allows. The algorithm chosen for each direction is the first algorithm to appear in the sender's list that the receiver supports, so it is important to list multiple algorithms in preferential order. If no algorithm can be agreed upon, the cmdlet will raise an error and the connection will be aborted.

At least one support algorithm must appear in this list. The following compression algorithms are supported by the cmdlet:

• zlib
• none

Default Value

"zlib,none"

Config Property (Invoke-PowerShellServer Cmdlet)

Specifies one or more configuration settings.

Syntax

Invoke-PowerShellServer -Config string[]

Remarks

The Config parameter takes one or more name-value pairs that represent the name of the configuration setting and value, i.e.: -config "Name=Value"

Default Value

null

Credential Property (Invoke-PowerShellServer Cmdlet)

The PSCredential object to use for user/password authentication.

Syntax

Invoke-PowerShellServer -Credential PSCredential

Remarks

Every cmdlet that supports user authentication will expose a Credential parameter. A PSCredential object should be specified for this parameter. Alternatively, the User and Password parameters can be set to represent the credential information.

If the cmdlet supports client key authentication it uses the password field of this object for the certificate's password. This setting is enabled by using public key authentication. Note: Due to security reasons, it is recommended that you use the Credential parameter rather than User and Password to specify the authentication information.

Default Value

null

Parameter Position

1

Parameter Alias

auth

EncryptionAlgorithms Property (Invoke-PowerShellServer Cmdlet)

A comma-separated list containing all allowable compression algorithms.

Syntax

Invoke-PowerShellServer -EncryptionAlgorithms string

Remarks

During the SSH handshake, this list will be used to negotiate the encryption algorithm to be used between the client and server. This list is used for both directions: client to server and server to client. When negotiating algorithms, each side sends a list of all algorithms it supports or allows. The algorithm chosen for each direction is the first algorithm to appear in the sender's list that the receiver supports, so it is important to list multiple algorithms in preferential order. If no algorithm can be agreed upon, the cmdlet will raise an error and the connection will be aborted.

At least one support algorithm must appear in this list. The following encryption algorithms are supported by the cmdlet:

By default, "aes256-cbc", the only encryption algorithm recommended by the SSH specification, and "3des-cbc", the only algorithm required, are enabled. It is not recommended to enable "none", as this defeats the purpose of an SSH connection.

Default Value

"aes256-cbc,3des-cbc"

FirewallHost Property (Invoke-PowerShellServer Cmdlet)

Name or IP address of firewall.

Syntax

Invoke-PowerShellServer -FirewallHost string

Remarks

If a FirewallHost is given, requested connections will be authenticated through the specified firewall when connecting.

If the FirewallHost parameter is set to a Domain Name, a DNS request is initiated. Upon successful termination of the request, the FirewallHost parameter is set to the corresponding address. If the search is not successful, an error is returned.

Default Value

""

FirewallPassword Property (Invoke-PowerShellServer Cmdlet)

A password if authentication is to be used when connecting through the firewall.

Syntax

Invoke-PowerShellServer -FirewallPassword string

Remarks

If FirewallHost is specified, the FirewallUser and FirewallPassword properties are used to authenticate against the firewall.

Default Value

""

FirewallPort Property (Invoke-PowerShellServer Cmdlet)

The port of the firewall to which to connect.

Syntax

Invoke-PowerShellServer -FirewallPort int

Remarks

The TCP port for the FirewallHost. See the description of the FirewallHost parameter for details.

Note that the FirewallPort is set automatically when FirewallType is set to a valid value. See the description of the FirewallType parameter for details. Setting this parameter will overwrite the default settings for the firewall port as specified by FirewallType.

Default Value

0

FirewallType Property (Invoke-PowerShellServer Cmdlet)

Determines the type of firewall to connect through.

Syntax

Invoke-PowerShellServer -FirewallType string

Remarks

The applicable values are the following:

Default Value

0

FirewallUser Property (Invoke-PowerShellServer Cmdlet)

A user name if authentication is to be used connecting through a firewall.

Syntax

Invoke-PowerShellServer -FirewallUser string

Remarks

If FirewallHost is specified, the FirewallUser and FirewallPassword properties are used to authenticate against the firewall.

Default Value

""

Force Property (Invoke-PowerShellServer Cmdlet)

Forces the component to accept the default behavior instead of querying the user.

Syntax

Invoke-PowerShellServer -Force SwitchParameter

Remarks

The Force parameter is especially useful in a script environment where user interaction is not an option. Certain cmdlets that are SSH and SSL based will query the user if the security credentials of the certificate presented by the server are not met. Setting this parameter will force the cmdlet to accept the certificate of the server unconditionally.

Default Value

false

LocalIP Property (Invoke-PowerShellServer Cmdlet)

The IP address of the local interface to use.

Syntax

Invoke-PowerShellServer -LocalIP string

Remarks

This parameter is useful when the cmdlet is running on a machine that has more than one network interface (each with its own IP address and network access privileges).

Default Value

""

Parameter Alias

LocalAddress

LogFile Property (Invoke-PowerShellServer Cmdlet)

The location of a file to which debug information is written.

Syntax

Invoke-PowerShellServer -LogFile string

Remarks

When specified, the cmdlet will log debug information to the file. If the file exists, the information will be appended.

Default Value

""

Password Property (Invoke-PowerShellServer Cmdlet)

The password to use for authentication.

Syntax

Invoke-PowerShellServer -Password string

Remarks

Every time User, or Password are set, the cmdlet will authenticate with the server. It is recommended that the Credential parameter is set instead of User/Password because of security reasons. If both Credential and this parameter is set, the Credential value is used.

Default Value

""

Port Property (Invoke-PowerShellServer Cmdlet)

The port to be used.

Syntax

Invoke-PowerShellServer -Port int

Remarks

Port specifies a service port on the remote host to which to connect.

A valid port number (a value between 1 and 65535) is required for the connection to take place.

Default Value

22

Server Property (Invoke-PowerShellServer Cmdlet)

The address of the Server.

Syntax

Invoke-PowerShellServer -Server string

Remarks

The cmdlet requires a server address to be provided. Either an IP address or the server host name can be provided.

Default Value

""

Parameter Position

0

This is a required parameter.

SSHAccept Property (Invoke-PowerShellServer Cmdlet)

The hex-encoded fingerprint of the host to trust explicitly.

Syntax

Invoke-PowerShellServer -SSHAccept string

Remarks

The fingerprint will be an MD5 hash of the host key in hex-encoded form, i.e. "0a:1b:2c:3d". Setting this will instruct the cmdlet to trust the fingerprint provided without prompting for verification.

After each connection, regardless of whether or not the key was trusted, the cmdlet will store the server's host key in the $SSHServerHostKey session variable. This variable can be inspected to view details of the server's key.

If the Force parameter is set, the cmdlet will accept the server's key unconditionally.

In cases where the host key presented by the server is not trusted, a prompt will be shown to the user. This prompt will allow the user to decide whether or not they would like to accept the host key presented by the server.

There may be cases where you do not want a prompt to be displayed or would like to handle the response supplied directly within your script. This can be done by setting the $SSHAcceptPreference variable prior to running the cmdlet. The available values for this variable are:

Default Value

""

Parameter Alias

Fingerprint

Timeout Property (Invoke-PowerShellServer Cmdlet)

The maximum time allowed for the operation.

Syntax

Invoke-PowerShellServer -Timeout int

Remarks

After the specified interval in seconds, the cmdlet will throw a Timeout error if the operation is not completed.

Default Value

10

User Property (Invoke-PowerShellServer Cmdlet)

The username to use for authentication.

Syntax

Invoke-PowerShellServer -User string

Remarks

Every time User and Password are set, the cmdlet will authenticate with the server. It is recommended that the Credential parameter is set instead of User/Password because of security reasons. If both Credential and this parameter is set, the Credential value is used.

Default Value

""

SSHOutput Output Object (Invoke-PowerShellServer Cmdlet)

The PSObject object returned by the Invoke-PowerShellServerExpression Component will have properties matching those of the original object in the remote machine.

Syntax

Object SSHOutput {
   string Property;
}

Remarks

The object coming back from the server is de-serialized into a PSObject with matching fields.

Config Settings (Invoke-PowerShellServer Cmdlet)

The cmdlet accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the cmdlet, access to these internal properties is provided through the Config method.

Invoke-PowerShellServer Config Settings

Base Config Settings