# Execute PowerShell scripts using a bastion host

> Use a bastion host to execute PowerShell scripts via the OneFuse Scripting Module

---

Site [llms.txt](/llms.txt)

---

This method allows for connection over PowerShell/WinRM to a target server. This is to support execution of scripts on Provisioned nodes that do not have SSH running.

Currently, the Scripting module only supports the use of OpenSSH connection types on Windows servers. This will require WinSSH to the Bastion host from the OneFuse appliance (TCP 22) to copy and execute the desired PowerShell script. Then, utilize WinRM (TCP 5985, 5986) to the Provisioned Node.

See [Resources](#resources) below for Microsoft's Documentation on Enable-PSRemoting on the Windows Guest.

<div class="alert alert-warning" role="alert">


The code provided in the walk-through is a sample only. It should be thoroughly reviewed and tested by those referencing it.
</div>


![How OneFuse uses a bastion host to connect to a provisioned node](/img/onefuse/configure/modules/scripting/bastion-host/bpd_onefuse-bastion-host.png)

## Goal

Provide a sample framework that can be modified based on environmental requirements.

## Set up bastion host

There are two options you can use to set up a proxy server to execute PowerShell scripts:

1. Basic PowerShell remoting to target server.
2. PowerShell remoting to allow different user authorization and/or authentication method.

<div class="alert alert-info" role="alert">


PowerShell code should be tested locally on the Bastion Server to ensure functionality.
</div>


![Bastion host example: OneFuse, bastion host and provisioned node](/img/onefuse/configure/modules/scripting/bastion-host/bpd_onefuse-bastion-host-example.png)

### Basic PowerShell remoting to target server

This method assumes passthrough authorization.

1. In the OneFuse Scripting Policy, copy and paste the following script into the **Launch Command** field: `powershell -ExecutionPolicy Bypass -File {{ scriptName }}`
2. In the OneFuse Scripting Policy, copy and paste the following script into the **Script Template** field:

   ```powershell
   Invoke-Command -ComputerName {{hostname}} -ScriptBlock {
       $path = "C:\Test_Script_Folder"
       New-Item -Path $path -ItemType "directory" -Force
       New-Item -Path $path -Name OneFuseExecution.txt -ItemType "file" -Value "This is an example script policy to execute on {{hostname}}."
   }
   ```

3. Add functional PowerShell code within the Script Block {}.

### PowerShell remoting for different user authorization and authentication

1. In the OneFuse Scripting Policy, copy and paste the following command into the **Launch Command** field: `powershell -ExecutionPolicy Bypass -File {{ scriptName }}`
2. In the OneFuse Scripting Policy, copy and paste the following script into the **Script Template** field:

   ```powershell
   param (
       $ComputerName,
       $Username,
       $Password
   )

   # Authentication can be changed to CredSSP (needs to be configured). Kerberos is the easier option
   $Authentication = "Kerberos"

   # Determing which Credentials to use based on what was passed in as a parameter
   if ($Username -and $Password) {
       $SecurePassword = ConvertTo-SecureString $Password -AsPlainText -Force
       $Credential = New-Object System.Management.Automation.PSCredential ($Username, $SecurePassword)
       Write-Host "Creating Credential Object"
   } else {
       $Username = "[username@domain]"
       $File = "C:\SovLabs\Password.txt"
       $Credential= New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $Username, (Get-Content $File | ConvertTo-SecureString)
       Write-Host "Generating Credential Object using hashed password from $File"
   }

   # Running commands on the target computer
   Invoke-Command -ComputerName $ComputerName -Authentication $Authentication -Credential $Credential -ScriptBlock {
       $path = "C:\Test_Script_Folder"
       New-Item -Path $path -ItemType "directory" -Force
       New-Item -Path $path -Name target_build_info2.txt -ItemType "file" -Value "This is a text string."
   }
   ```

3. If desired, change the Authentication Method, or create a Password File in the code above. Add functional PowerShell code within the Script Block {}.

## Resources

- [Microsoft's Documentation Enable-PSRemoting](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.1)
- [OneFuse Scripting for vRealize Automation 7](/docs/onefuse/consume/vmware-aria-automation/vrealize-automation-76/modules/scripting/)
- [OneFuse Scripting for Aria Automation 8](/docs/onefuse/consume/vmware-aria-automation/aria-automation-8x/modules/scripting/)
- [OneFuse Scripting for Terraform](/docs/onefuse/consume/hashicorp-terraform/modules/scripting/)