118 lines
3.4 KiB
PowerShell
118 lines
3.4 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
PS 12: Sicherheit, Execution Policies & Secrets Management - Musterlösung
|
|
#>
|
|
|
|
function New-SecureCredentials {
|
|
[CmdletBinding()]
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$UserName,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$PlainTextPassword
|
|
)
|
|
|
|
$secPass = ConvertTo-SecureString -String $PlainTextPassword -AsPlainText -Force
|
|
return [PSCredential]::new($UserName, $secPass)
|
|
}
|
|
|
|
function Protect-SensitiveString {
|
|
[CmdletBinding()]
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$PlainText
|
|
)
|
|
|
|
$sec = ConvertTo-SecureString -String $PlainText -AsPlainText -Force
|
|
return ConvertFrom-SecureString -SecureString $sec
|
|
}
|
|
|
|
function Unprotect-SensitiveString {
|
|
[CmdletBinding()]
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$EncryptedString
|
|
)
|
|
|
|
$sec = ConvertTo-SecureString -String $EncryptedString
|
|
$cred = [System.Net.NetworkCredential]::new('', $sec)
|
|
return $cred.Password
|
|
}
|
|
|
|
function Get-SecurityAuditReport {
|
|
[CmdletBinding()]
|
|
param()
|
|
|
|
$langMode = [string]$ExecutionContext.SessionState.LanguageMode
|
|
$policy = try { (Get-ExecutionPolicy).ToString() } catch { "RemoteSigned" }
|
|
|
|
$isElevated = if ($IsWindows) {
|
|
$currentPrincipal = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
|
|
$currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
|
|
} else {
|
|
try { ((whoami) -eq 'root') } catch { $false }
|
|
}
|
|
|
|
$score = 100
|
|
$recommendations = [System.Collections.Generic.List[string]]::new()
|
|
|
|
if ($policy -in @('Unrestricted', 'Bypass')) {
|
|
$score -= 30
|
|
$recommendations.Add("Set-ExecutionPolicy auf 'RemoteSigned' oder 'AllSigned' beschränken.")
|
|
}
|
|
if ($langMode -eq 'FullLanguage' -and $isElevated) {
|
|
$recommendations.Add("Prinzip der geringsten Rechte (Least Privilege) beachten: Nicht dauerhaft mit Root/Admin-Rechten arbeiten.")
|
|
}
|
|
|
|
return [PSCustomObject]@{
|
|
LanguageMode = $langMode
|
|
ExecutionPolicy = $policy
|
|
IsElevated = [bool]$isElevated
|
|
SecurityScore = [Math]::Max(0, $score)
|
|
Recommendations = @($recommendations)
|
|
}
|
|
}
|
|
|
|
function Invoke-SecretVaultSimulation {
|
|
[CmdletBinding()]
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidateSet('Set', 'Get', 'Remove', 'List')]
|
|
[string]$Action,
|
|
|
|
[Parameter()]
|
|
[string]$SecretName,
|
|
|
|
[Parameter()]
|
|
[string]$SecretValue,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[hashtable]$VaultStorage
|
|
)
|
|
|
|
switch ($Action) {
|
|
'Set' {
|
|
if (-not $SecretName) { throw "SecretName ist erforderlich für Set." }
|
|
$VaultStorage[$SecretName] = Protect-SensitiveString -PlainText $SecretValue
|
|
return $true
|
|
}
|
|
'Get' {
|
|
if (-not $SecretName -or -not $VaultStorage.ContainsKey($SecretName)) {
|
|
return $null
|
|
}
|
|
$enc = $VaultStorage[$SecretName]
|
|
return Unprotect-SensitiveString -EncryptedString $enc
|
|
}
|
|
'Remove' {
|
|
if ($VaultStorage.ContainsKey($SecretName)) {
|
|
$VaultStorage.Remove($SecretName)
|
|
return $true
|
|
}
|
|
return $false
|
|
}
|
|
'List' {
|
|
return @($VaultStorage.Keys | Sort-Object)
|
|
}
|
|
}
|
|
}
|