Something went wrong. Try again.
Monorepo for Aesthetic.Computer aesthetic.computer
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163$ErrorActionPreference = "Stop"
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()$principal = [Security.Principal.WindowsPrincipal]::new($identity)if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { throw "Run Windows Terminal as Administrator, then run this command again."}
$tailscale = Join-Path $env:ProgramFiles "Tailscale\tailscale.exe"if (-not (Test-Path $tailscale)) { throw "Tailscale is not installed in its standard location."}
$windows = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"Write-Host "Windows: $($windows.ProductName) ($($windows.EditionID))"if ($windows.EditionID -match "^(Core|CoreSingleLanguage|CoreCountrySpecific|Home)") { throw "This Windows Home edition cannot host Microsoft Remote Desktop."}
# Tailscale's device-local Shields Up preference drops inbound connections even# when the tailnet access policy and Windows Firewall allow them.& $tailscale set --shields-up=falseif ($LASTEXITCODE -ne 0) { throw "Tailscale could not disable Shields Up."}
$terminalServer = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server"$rdpTcp = Join-Path $terminalServer "WinStations\RDP-Tcp"Set-ItemProperty $terminalServer -Name fDenyTSConnections -Value 0Set-ItemProperty $rdpTcp -Name fEnableWinStation -Value 1$rdpPort = (Get-ItemProperty $rdpTcp -Name PortNumber).PortNumberSet-Service -Name TermService -StartupType AutomaticStart-Service -Name TermService$terminalSettings = Get-CimInstance ` -Namespace "root\cimv2\TerminalServices" ` -ClassName "Win32_TerminalServiceSetting"$allowResult = Invoke-CimMethod ` -InputObject $terminalSettings ` -MethodName "SetAllowTSConnections" ` -Arguments @{ AllowTSConnections = 1; ModifyFirewallException = 0 }Start-Sleep -Seconds 2
# Keep RDP limited to peers arriving from Tailscale's IPv4 address range. The# tailnet access policy remains an additional authorization layer.Get-NetFirewallRule -Name "RemoteDesktop*" -ErrorAction SilentlyContinue | Disable-NetFirewallRule$ruleName = "Remote Desktop over Tailscale"$rule = Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinueif ($null -eq $rule) { $rule = New-NetFirewallRule ` -DisplayName $ruleName ` -Direction Inbound ` -Action Allow ` -Protocol TCP ` -LocalPort $rdpPort ` -RemoteAddress "100.64.0.0/10" ` -Profile Any} else { $rule | Set-NetFirewallRule -Enabled True -Direction Inbound -Action Allow -Profile Any $rule | Get-NetFirewallPortFilter | Set-NetFirewallPortFilter -Protocol TCP -LocalPort $rdpPort $rule | Get-NetFirewallAddressFilter | Set-NetFirewallAddressFilter -RemoteAddress "100.64.0.0/10"}
# Configure an already-installed Windows OpenSSH endpoint for maintenance.# Only Blueberry's tailnet IP can reach it, and only Blueberry's dedicated# public key is authorized; no password is copied into this script.$sshService = Get-Service -Name sshd -ErrorAction SilentlyContinue$sshState = if ($null -ne $sshService) { "Installed" } else { "NotPresent" }if ($sshState -eq "Installed") { $authorizedKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKBhGVdx9XGursPqyJPf1f7ijcKL7B579F7/LpcPdveb blueberry-to-skips-surface" $authorizedKeysPath = Join-Path $env:ProgramData "ssh\administrators_authorized_keys" $authorizedKeysDirectory = Split-Path $authorizedKeysPath New-Item -ItemType Directory -Force -Path $authorizedKeysDirectory | Out-Null $authorizedKeys = @(Get-Content $authorizedKeysPath -ErrorAction SilentlyContinue) if ($authorizedKeys -notcontains $authorizedKey) { @($authorizedKeys + $authorizedKey) | Set-Content -Path $authorizedKeysPath -Encoding ascii } & icacls.exe $authorizedKeysPath /inheritance:r /grant:r "*S-1-5-32-544:F" "*S-1-5-18:F" | Out-Null if ($LASTEXITCODE -ne 0) { throw "Could not secure the Windows OpenSSH authorized-keys file." }
Set-Service -Name sshd -StartupType Automatic Start-Service -Name sshd
# The optional-feature installer creates a broad port-22 rule. Replace its # effect with the Blueberry-only rule below. Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue | Disable-NetFirewallRule $sshRuleName = "OpenSSH over Tailscale from Blueberry" $sshRule = Get-NetFirewallRule -DisplayName $sshRuleName -ErrorAction SilentlyContinue if ($null -eq $sshRule) { New-NetFirewallRule ` -DisplayName $sshRuleName ` -Direction Inbound ` -Action Allow ` -Protocol TCP ` -LocalPort 22 ` -RemoteAddress "100.79.75.53" ` -Profile Any | Out-Null } else { $sshRule | Set-NetFirewallRule -Enabled True -Direction Inbound -Action Allow -Profile Any $sshRule | Get-NetFirewallPortFilter | Set-NetFirewallPortFilter -Protocol TCP -LocalPort 22 $sshRule | Get-NetFirewallAddressFilter | Set-NetFirewallAddressFilter -RemoteAddress "100.79.75.53" }} else { Write-Host "SSH SKIPPED: Windows optional feature is $sshState."}
$listener = Get-NetTCPConnection -LocalPort $rdpPort -State Listen -ErrorAction SilentlyContinue$tailscaleIp = & $tailscale ip -4$rdpReady = $null -ne $listener$terminalService = Get-CimInstance Win32_Service -Filter "Name='TermService'"$sessionEnv = Get-Service -Name SessionEnv -ErrorAction SilentlyContinue$userModeRdp = Get-Service -Name UmRdpService -ErrorAction SilentlyContinue$policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"$policy = Get-ItemProperty $policyPath -ErrorAction SilentlyContinue$terminalSettings = Get-CimInstance ` -Namespace "root\cimv2\TerminalServices" ` -ClassName "Win32_TerminalServiceSetting"$diagnostic = [ordered]@{ user = $env:USERNAME product = $windows.ProductName edition = $windows.EditionID build = $windows.CurrentBuild rdpReady = $rdpReady rdpPort = $rdpPort allowResult = $allowResult.ReturnValue allowTSConnections = $terminalSettings.AllowTSConnections denyConnections = (Get-ItemProperty $terminalServer).fDenyTSConnections policyDenyConnections = $policy.fDenyTSConnections enableWinStation = (Get-ItemProperty $rdpTcp).fEnableWinStation termServiceState = $terminalService.State termServiceStartMode = $terminalService.StartMode termServicePid = $terminalService.ProcessId sessionEnv = $sessionEnv.Status umRdpService = $userModeRdp.Status ssh = $sshState}$diagnosticJson = $diagnostic | ConvertTo-Json -Compress$diagnosticBytes = [Text.Encoding]::UTF8.GetBytes($diagnosticJson)$diagnosticEncoded = [Uri]::EscapeDataString([Convert]::ToBase64String($diagnosticBytes))try { Invoke-WebRequest -UseBasicParsing -Uri "http://blueberry:8765/diag?d=$diagnosticEncoded" | Out-Null} catch { # The tiny setup server intentionally returns 404 for this status beacon; # its request log is the feedback channel until SSH is available.}
if ($sshState -eq "Installed") { Write-Host "SSH READY: $($env:USERNAME)@${tailscaleIp}"}if (-not $rdpReady) { $service = Get-Service -Name TermService throw "RDP is not listening on TCP $rdpPort (TermService: $($service.Status)); diagnostic report sent."}Write-Host "RDP READY: ${tailscaleIp}:$rdpPort"