Windows AMIs Without The Tears

Write-Host "Disabling WinRM over HTTP..."
Disable-NetFirewallRule -Name "WINRM-HTTP-In-TCP"
Disable-NetFirewallRule -Name "WINRM-HTTP-In-TCP-PUBLIC"

Start-Process -FilePath winrm `
    -ArgumentList "delete winrm/config/listener?Address=*+Transport=HTTP" `
    -NoNewWindow -Wait

Write-Host "Configuring WinRM for HTTPS..."
Start-Process -FilePath winrm `
    -ArgumentList "set winrm/config @{MaxTimeoutms=`"1800000`"}" `
    -NoNewWindow -Wait

Start-Process -FilePath winrm `
    -ArgumentList "set winrm/config/winrs @{MaxMemoryPerShellMB=`"1024`"}" `
    -NoNewWindow -Wait

Start-Process -FilePath winrm `
    -ArgumentList "set winrm/config/service @{AllowUnencrypted=`"false`"}" `
    -NoNewWindow -Wait

Start-Process -FilePath winrm `
    -ArgumentList "set winrm/config/service/auth @{Basic=`"true`"}" `
    -NoNewWindow -Wait

Start-Process -FilePath winrm `
    -ArgumentList "set winrm/config/service/auth @{CredSSP=`"true`"}" `
    -NoNewWindow -Wait

New-NetFirewallRule -Name "WINRM-HTTPS-In-TCP" `
    -DisplayName "Windows Remote Management (HTTPS-In)" `
    -Description "Inbound rule for Windows Remote Management via WS-Management. [TCP 5986]" `
    -Group "Windows Remote Management" `
    -Program "System" `
    -Protocol TCP `
    -LocalPort "5986" `
    -Action Allow `
    -Profile Domain,Private

New-NetFirewallRule -Name "WINRM-HTTPS-In-TCP-PUBLIC" `
    -DisplayName "Windows Remote Management (HTTPS-In)" `
    -Description "Inbound rule for Windows Remote Management via WS-Management. [TCP 5986]" `
    -Group "Windows Remote Management" `
    -Program "System" `
    -Protocol TCP `
    -LocalPort "5986" `
    -Action Allow `
    -Profile Public

$certContent = "<insert a base 64 encoded version of your certificate here>"

$certBytes = [System.Convert]::FromBase64String($certContent)
$pfx = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$pfx.Import($certBytes, "", "Exportable,PersistKeySet,MachineKeySet")
$certThumbprint = $pfx.Thumbprint
$certSubjectName = $pfx.SubjectName.Name.TrimStart("CN = ").Trim()

$store = new-object System.Security.Cryptography.X509Certificates.X509Store("My", "LocalMachine")
try {
    $store.Open("ReadWrite,MaxAllowed")
    $store.Add($pfx)

} finally {
    $store.Close()
}

Start-Process -FilePath winrm `
    -ArgumentList "create winrm/config/listener?Address=*+Transport=HTTPS @{Hostname=`"$certSubjectName`";CertificateThumbprint=`"$certThumbprint`";Port=`"5986`"}" `
    -NoNewWindow -Wait

# This part is optional
$user = [adsi]"WinNT://localhost/Administrator,user"
$user.SetPassword("Insert a new Administrator password here")
$user.SetInfo()

Write-Host "Restarting WinRM Service..."
Stop-Service winrm
Set-Service winrm -StartupType "Automatic"
Start-Service winrm

set -e

CERTNAME=${1:-packer-winrm-$RANDOM}
SUBJECT="/CN=$CERTNAME"

PFX_FILE=${2:-winrm_server_cert}.pfx
PEM_FILE=${PFX_FILE%.*}.pem

PRIVATE_DIR=`mktemp -d -t packer-certXXXXXX`
chmod 700 $PRIVATE_DIR

EXT_CONF_FILE=`mktemp -t packer-certXXXXXX.conf`

KEY_FILE=$PRIVATE_DIR/cert.key

cat > $EXT_CONF_FILE << EOF
distinguished_name  = req_distinguished_name
[req_distinguished_name]
[v3_req_server]
extendedKeyUsage = serverAuth
EOF

export OPENSSL_CONF=$EXT_CONF_FILE
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -out "$PEM_FILE" \
    -outform PEM -keyout $KEY_FILE -subj "$SUBJECT" \
    -extensions v3_req_server 2> /dev/null

rm $EXT_CONF_FILE
unset OPENSSL_CONF

openssl pkcs12 -export -in "$PEM_FILE" -inkey $KEY_FILE -out "$PFX_FILE" -password pass:""

rm -rf $PRIVATE_DIR

THUMBPRINT=`openssl x509 -inform PEM -in "$PEM_FILE" -fingerprint -noout | \
    sed -e 's/\://g' | sed -n 's/^.*=\(.*\)$/\1/p'`

echo "Certificate Subject: $(echo \"$SUBJECT\" | sed -e 's/\///g')"
echo "Certificate Thumbprint: $THUMBPRINT"

// Response to a GetPasswordData request.
//
// If PasswordData is empty, then one of two conditions is likely: either the
// instance is not running Windows, or the password is not yet available. The
// API documentation suggests that the password should be available within 15
// minutes of launch.
//
// See http://goo.gl/7Dppx0 for more details.
type PasswordDataResponse struct {
	RequestId    string    `xml:"requestId"`
	InstanceId   string    `xml:"instanceId"`
	Timestamp    time.Time `xml:"timestamp"`
	PasswordData string    `xml:"passwordData"`
}

// GetPasswordData retrieves the encrypted administrator password for an
// instance running Windows. The password is encrypted using the key pair,
// so must be decrypted with the corresponding key pair file.
//
// See http://goo.gl/7Dppx0 for more details.
func (ec2 *EC2) GetPasswordData(instId string) (resp *PasswordDataResponse, err error) {
	params := makeParams("GetPasswordData")
	addParamsList(params, "InstanceId", []string{instId})
	resp = &PasswordDataResponse{}
	ec2.query(params, resp)
	if err != nil {
		return nil, err
	}
	return
}

package common

import (
	"bytes"
	"encoding/base64"
	"fmt"
	"io/ioutil"
	"text/template"

	"github.com/mitchellh/multistep"
	"github.com/mitchellh/packer/packer"

	wincommon "github.com/packer-community/packer-windows-plugins/common"
)

type StepGenerateSecureWinRMUserData struct {
	WinRMConfig          *wincommon.WinRMConfig
	WinRMCertificateFile string
	RunConfig            *RunConfig
}

func (s *StepGenerateSecureWinRMUserData) Run(state multistep.StateBag) multistep.StepAction {
	ui := state.Get("ui").(packer.Ui)

	if !s.RunConfig.ConfigureSecureWinRM {
		return multistep.ActionContinue
	}

	ui.Say("Generating user data for configuring WinRM over TLS...")

	certBytes, err := ioutil.ReadFile(s.WinRMCertificateFile)
	if err != nil {
		ui.Error(fmt.Sprintf("Error reading WinRM certificate file: %s", err))
		return multistep.ActionHalt
	}

	encodedCert := base64.StdEncoding.EncodeToString(certBytes)

	var adminPasswordBuffer bytes.Buffer
	if s.RunConfig.NewAdministratorPassword != "" {
		ui.Say("Configuring user data to change Administrator password...")
		err = changeAdministratorPasswordTemplate.Execute(&adminPasswordBuffer, changeAdministratorPasswordOptions{
			NewAdministratorPassword: s.RunConfig.NewAdministratorPassword,
		})
		if err != nil {
			ui.Error(fmt.Sprintf("Error executing Change Administrator Password template: %s", err))
			return multistep.ActionHalt
		}
	}

	var buffer bytes.Buffer
	err = configureSecureWinRMTemplate.Execute(&buffer, configureSecureWinRMOptions{
		CertificatePfxBase64Encoded:        encodedCert,
		InstallListenerCommand:             installListenerCommand,
		AllowBasicCommand:                  allowBasicCommand,
		AllowUnencryptedCommand:            allowUnencryptedCommand,
		AllowCredSSPCommand:                allowCredSSPCommand,
		MaxMemoryPerShellCommand:           maxMemoryPerShellCommand,
		MaxTimeoutMsCommand:                maxTimeoutMsCommand,
		ChangeAdministratorPasswordCommand: adminPasswordBuffer.String(),
	})
	if err != nil {
		ui.Error(fmt.Sprintf("Error executing Secure WinRM User Data template: %s", err))
		return multistep.ActionHalt
	}

	s.RunConfig.UserData = buffer.String()
	return multistep.ActionContinue
}

func (s *StepGenerateSecureWinRMUserData) Cleanup(multistep.StateBag) {
	// No cleanup...
}

type changeAdministratorPasswordOptions struct {
	NewAdministratorPassword string
}

var changeAdministratorPasswordTemplate = template.Must(template.New("ChangeAdministratorPassword").Parse(`$user = [adsi]"WinNT://localhost/Administrator,user"
$user.SetPassword("{{.NewAdministratorPassword}}")
$user.SetInfo()`))

type configureSecureWinRMOptions struct {
	CertificatePfxBase64Encoded        string
	InstallListenerCommand             string
	AllowBasicCommand                  string
	AllowUnencryptedCommand            string
	AllowCredSSPCommand                string
	MaxMemoryPerShellCommand           string
	MaxTimeoutMsCommand                string
	ChangeAdministratorPasswordCommand string
}

//This is needed to because Powershell uses ` for escapes and there's no straightforward way of constructing
// the necessary escaping in the hash otherwise.
const (
	installListenerCommand = "Start-Process -FilePath winrm -ArgumentList \"create winrm/config/listener?Address=*+Transport=HTTPS @{Hostname=`\"$certSubjectName`\";CertificateThumbprint=`\"$certThumbprint`\";Port=`\"5986`\"}\" -NoNewWindow -Wait"

	allowBasicCommand        = "Start-Process -FilePath winrm -ArgumentList \"set winrm/config/service/auth @{Basic=`\"true`\"}\" -NoNewWindow -Wait"
	allowUnencryptedCommand  = "Start-Process -FilePath winrm -ArgumentList \"set winrm/config/service @{AllowUnencrypted=`\"false`\"}\" -NoNewWindow -Wait"
	allowCredSSPCommand      = "Start-Process -FilePath winrm -ArgumentList \"set winrm/config/service/auth @{CredSSP=`\"true`\"}\" -NoNewWindow -Wait"
	maxMemoryPerShellCommand = "Start-Process -FilePath winrm -ArgumentList \"set winrm/config/winrs @{MaxMemoryPerShellMB=`\"1024`\"}\" -NoNewWindow -Wait"
	maxTimeoutMsCommand      = "Start-Process -FilePath winrm -ArgumentList \"set winrm/config @{MaxTimeoutms=`\"1800000`\"}\" -NoNewWindow -Wait"
)

var configureSecureWinRMTemplate = template.Must(template.New("ConfigureSecureWinRM").Parse(`<powershell>
Write-Host "Disabling WinRM over HTTP..."
Disable-NetFirewallRule -Name "WINRM-HTTP-In-TCP"
Disable-NetFirewallRule -Name "WINRM-HTTP-In-TCP-PUBLIC"

Start-Process -FilePath winrm -ArgumentList "delete winrm/config/listener?Address=*+Transport=HTTP" -NoNewWindow -Wait

Write-Host "Configuring WinRM for HTTPS..."

.MaxTimeoutMsCommand

.MaxMemoryPerShellCommand

.AllowUnencryptedCommand

.AllowBasicCommand

.AllowCredSSPCommand

New-NetFirewallRule -Name "WINRM-HTTPS-In-TCP" -DisplayName "Windows Remote Management (HTTPS-In)" -Description "Inbound rule for Windows Remote Management via WS-Management. [TCP 5986]" -Group "Windows Remote Management" -Program "System" -Protocol TCP -LocalPort "5986" -Action Allow -Profile Domain,Private

New-NetFirewallRule -Name "WINRM-HTTPS-In-TCP-PUBLIC" -DisplayName "Windows Remote Management (HTTPS-In)" -Description "Inbound rule for Windows Remote Management via WS-Management. [TCP 5986]" -Group "Windows Remote Management" -Program "System" -Protocol TCP -LocalPort "5986" -Action Allow -Profile Public

$certContent = "{{.CertificatePfxBase64Encoded}}"

$certBytes = [System.Convert]::FromBase64String($certContent)
$pfx = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$pfx.Import($certBytes, "", "Exportable,PersistKeySet,MachineKeySet")
$certThumbprint = $pfx.Thumbprint
$certSubjectName = $pfx.SubjectName.Name.TrimStart("CN = ").Trim()

$store = new-object System.Security.Cryptography.X509Certificates.X509Store("My", "LocalMachine")
try {
    $store.Open("ReadWrite,MaxAllowed")
    $store.Add($pfx)

} finally {
    $store.Close()
}

.InstallListenerCommand

.ChangeAdministratorPasswordCommand

Write-Host "Restarting WinRM Service..."
Stop-Service winrm
Set-Service winrm -StartupType "Automatic"
Start-Service winrm
</powershell>`))

package common

import (
	"crypto/rsa"
	"crypto/x509"
	"encoding/base64"
	"encoding/pem"
	"errors"
	"fmt"
	"log"
	"time"

	"code.google.com/p/gosshold/ssh/terminal"

	"github.com/mitchellh/goamz/ec2"
	"github.com/mitchellh/multistep"
	"github.com/mitchellh/packer/packer"

	wincommon "github.com/packer-community/packer-windows-plugins/common"
)

type StepGetPassword struct {
	WinRMConfig        *wincommon.WinRMConfig
	RunConfig          *RunConfig
	GetPasswordTimeout time.Duration
}

func (s *StepGetPassword) Run(state multistep.StateBag) multistep.StepAction {
	ui := state.Get("ui").(packer.Ui)
	instance := state.Get("instance").(*ec2.Instance)

	if s.RunConfig.NewAdministratorPassword != "" {
		s.WinRMConfig.WinRMPassword = s.RunConfig.NewAdministratorPassword
		return multistep.ActionContinue
	}

	var password string
	var err error

	cancel := make(chan struct{})
	waitDone := make(chan bool, 1)
	go func() {
		ui.Say(fmt.Sprintf("Retrieving auto-generated password for instance %s...", instance.InstanceId))

		password, err = s.waitForPassword(state, cancel)
		if err != nil {
			waitDone <- false
			return
		}
		waitDone <- true
	}()

	log.Printf("Waiting to retrieve instance %s password, up to timeout: %s", instance.InstanceId, s.GetPasswordTimeout)
	timeout := time.After(s.GetPasswordTimeout)

WaitLoop:
	for {
		// Wait for one of: the password becoming available, a timeout occuring
		// or an interrupt coming through.
		select {
		case <-waitDone:
			if err != nil {
				state.Put("error", err)
				ui.Error(err.Error())
				return multistep.ActionHalt
			}

			s.WinRMConfig.WinRMPassword = password
			break WaitLoop

		case <-timeout:
			err := fmt.Errorf(fmt.Sprintf("Timeout retrieving password for instance %s", instance.InstanceId))
			state.Put("error", err)
			ui.Error(err.Error())
			close(cancel)
			return multistep.ActionHalt

		case <-time.After(1 * time.Second):
			if _, ok := state.GetOk(multistep.StateCancelled); ok {
				// Build was cancelled.
				close(cancel)
				log.Println("Interrupt detected, cancelling password retrieval")
				return multistep.ActionHalt
			}
		}
	}

	return multistep.ActionContinue

}

func (s *StepGetPassword) waitForPassword(state multistep.StateBag, cancel <-chan struct{}) (string, error) {
	ec2conn := state.Get("ec2").(*ec2.EC2)
	instance := state.Get("instance").(*ec2.Instance)
	privateKey := state.Get("privateKey").(string)

	for {
		select {
		case <-cancel:
			log.Println("Retrieve password wait cancelled. Exiting loop.")
			return "", errors.New("Retrieve password wait cancelled")

		case <-time.After(20 * time.Second):
		}

		resp, err := ec2conn.GetPasswordData(instance.InstanceId)
		if err != nil {
			err := fmt.Errorf("Error retrieving auto-generated instance password: %s", err)
			return "", err
		}

		if resp.PasswordData != "" {
			decryptedPassword, err := decryptPasswordDataWithPrivateKey(resp.PasswordData, []byte(privateKey))
			if err != nil {
				err := fmt.Errorf("Error decrypting auto-generated instance password: %s", err)
				return "", err
			}
			return decryptedPassword, nil
		}
	}
}

func (s *StepGetPassword) Cleanup(multistep.StateBag) {
	// No cleanup...
}

func decryptPasswordDataWithPrivateKey(passwordData string, pemBytes []byte) (string, error) {
	encryptedPasswd, err := base64.StdEncoding.DecodeString(passwordData)
	if err != nil {
		return "", err
	}

	block, _ := pem.Decode(pemBytes)
	var asn1Bytes []byte
	if _, ok := block.Headers["DEK-Info"]; ok {
		fmt.Printf("Encrypted private key. Please enter passphrase: ")
		password, err := terminal.ReadPassword(0)
		fmt.Printf("\n")
		if err != nil {
			return "", err
		}

		asn1Bytes, err = x509.DecryptPEMBlock(block, password)
		if err != nil {
			return "", err
		}
	} else {
		asn1Bytes = block.Bytes
	}

	key, err := x509.ParsePKCS1PrivateKey(asn1Bytes)
	if err != nil {
		return "", err
	}

	out, err := rsa.DecryptPKCS1v15(nil, key, encryptedPasswd)
	if err != nil {
		return "", err
	}

	return string(out), nil
}

	// Build the steps
	steps := []multistep.Step{
		&winawscommon.StepGenerateSecureWinRMUserData{
			RunConfig:            &b.config.RunConfig,
			WinRMConfig:          &b.config.WinRMConfig,
			WinRMCertificateFile: b.config.WinRMCertificateFile,
		},
		&awscommon.StepSourceAMIInfo{
			SourceAmi:          b.config.SourceAmi,
			EnhancedNetworking: b.config.AMIEnhancedNetworking,
		},
		&awscommon.StepKeyPair{
			Debug:          b.config.PackerDebug,
			DebugKeyPath:   fmt.Sprintf("ec2_%s.pem", b.config.PackerBuildName),
			KeyPairName:    b.config.TemporaryKeyPairName,
			PrivateKeyFile: b.config.KeyPairPrivateKeyFile,
		},
		&winawscommon.StepSecurityGroup{
			SecurityGroupIds: b.config.SecurityGroupIds,
			WinRMPort:        b.config.WinRMPort,
			VpcId:            b.config.VpcId,
		},
		&winawscommon.StepRunSourceInstance{
			Debug:              b.config.PackerDebug,
			ExpectedRootDevice: "ebs",
			BlockDevices:       &b.config.BlockDevices,
			RunConfig:          &b.config.RunConfig,
		},
		&winawscommon.StepGetPassword{
			WinRMConfig:        &b.config.WinRMConfig,
			RunConfig:          &b.config.RunConfig,
			GetPasswordTimeout: 5 * time.Minute,
		},
		winawscommon.NewConnectStep(ec2conn, b.config.WinRMPrivateIp, &b.config.WinRMConfig),
		&common.StepProvision{},
		&stepStopInstance{SpotPrice: b.config.SpotPrice},
		// TODO(mitchellh): verify works with spots
		&stepModifyInstance{},
		&stepCreateAMI{},
		&awscommon.StepAMIRegionCopy{
			Regions: b.config.AMIRegions,
		},
		&awscommon.StepModifyAMIAttributes{
			Description: b.config.AMIDescription,
			Users:       b.config.AMIUsers,
			Groups:      b.config.AMIGroups,
		},
		&awscommon.StepCreateTags{
			Tags: b.config.AMITags,
		},
	}

{
    "builders": [
        {
            "type": "amazon-windows-ebs",
            "region": "us-east-1",
            "source_ami": "ami-b27830da",
            "instance_type": "t2.micro",
            "ami_name": "windows-ami-{{timestamp}}",
            "associate_public_ip_address":true,
            
            "winrm_username": "Administrator",
            "winrm_wait_timeout": "10m",
            "winrm_autoconfigure": true,
            "winrm_certificate_file": "winrm_server_cert.pfx",
            "winrm_ignore_cert_chain": true
        }
    ],
    "provisioners": [
        {
            "type": "powershell",
            "inline": [
                "dir c:\\"
            ]
        }
    ]
}

function Format-XML ([xml]$xml, $indent=2) 
{ 
    $StringWriter = New-Object System.IO.StringWriter 
    $XmlWriter = New-Object System.XMl.XmlTextWriter $StringWriter 
    $xmlWriter.Formatting = "indented" 
    $xmlWriter.Indentation = $Indent 
    $xml.WriteContentTo($XmlWriter) 
    $XmlWriter.Flush() 
    $StringWriter.Flush() 
    Write-Output $StringWriter.ToString() 
}

$ec2ConfigPath = Join-Path (Get-Item Env:\ProgramFiles).Value "Amazon\Ec2ConfigService\Settings"

$ec2ConfigFile = Join-Path $ec2ConfigPath "Config.xml"
$ec2BundleConfigFile = Join-Path $ec2ConfigPath "BundleConfig.xml"

#EC2Config
[xml]$config = Get-Content -Path $ec2ConfigFile
foreach ($t in $config.EC2ConfigurationSettings.Plugins.Plugin) {
    if ($t.Name -eq "Ec2SetPassword") {
        $t.State = "{{.EC2SetPassword}}"
    }
    if ($t.Name -eq "Ec2HandleUserData") {
        $t.State = "{{.EC2HandleUserData}}"
    }
}
Format-XML $config.InnerXml | Set-Content -Path $ec2ConfigFile

[xml]$bundleConfig = Get-Content -Path $ec2BundleConfigFile
foreach ($t in $bundleConfig.BundleConfig.Property) {
    if ($t.Name -eq "AutoSysprep") {
        $t.Value = "{{.AutoSysPrep}}"
    }
    if ($t.Name -eq "SetPasswordAfterSysprep") {
        $t.Value = "{{.SetPasswordAfterSysprep}}"
    }
}
Format-XML $bundleConfig.InnerXml | Set-Content -Path $ec2BundleConfigFile