Disable OpenSSH on Windows servers

Use OneFuse Scripting to uninstall OpenSSH from Windows servers via a bastion host

  2 minute read  

Currently, SSH is the only supported connection method in OneFuse. Trying to uninstall OpenSSH while connected using it is problematic. This method uses WinRM to connect to the target server to uninstall OpenSSH.

This article assumes you have a bastion/jump server configured with OpenSSH, and that your Windows templates already have OpenSSH installed. This has only been tested on Windows 2016 and 2019, but may work on other versions of Windows with modification.

Goal: Provide a sample framework that can be modified based on environmental requirements.

Create a Scripting Policy in OneFuse

  1. In the OneFuse Scripting Module, paste the following into the Launch Command field:

    powershell -ExecutionPolicy Bypass -File {{ scriptName }}

  2. Paste the following script into the Script Template field.

    This uses basic PowerShell Remoting to the target server (assumes passthrough authorization).

    Invoke-Command -ComputerName {{OneFuse_VmNic0.hostname}} -ScriptBlock {
    # Initial Variables
    $OSVersion = (Get-WmiObject -class Win32_OperatingSystem).Caption
    # Logging
    $Log = "C:\SovLabs\Uninstall.txt"
    if ($OSVersion -match 2019) {
        Remove-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
        # Rebooting Server
        shutdown /r /f /t 60
    } else {
        Start-Process powershell -ArgumentList "C:\OpenSSH\OpenSSH-Win64\uninstall-sshd.ps1" -Wait -Verbose -RedirectStandardOutput $Log
        $Service = Get-Service -Name sshd -ErrorAction SilentlyContinue
        if ($Service) {
            throw "Failed to uninstall SSH"
        }
        # Checking if Firewall exists
        $FirewallRule = Get-NetFirewallRule -Name sshd -ErrorAction SilentlyContinue
        if ($FirewallRule) {Remove-NetFirewallRule -Name sshd -ErrorAction SilentlyContinue}
        # Removing Directory
        $OpenSSHDir = Get-Item -Path "C:\OpenSSH" -ErrorAction SilentlyContinue
        if ($OpenSSHDir) {Remove-Item "C:\OpenSSH" -Recurse -Force -ErrorAction SilentlyContinue}
    }
}

Add Scripting Policy to vRealize Automation Blueprint

  1. Go to your vRealize Automation instance.
  2. Open the blueprint you use for Scripting.
  3. Add the OneFuse_ScriptingPolicy_ComputeProvisionPostLate_001OpenSSHUninstall property to your blueprint with the value 'OneFuse:SSHUninstall'.
  4. Once the property is added, you are ready to test the SSH uninstall. For more information, see the links in the Resources section.

Resources