Add managed RustDesk enrollment for Linux clients

2026-09-08 08:27:11 -06:00
parent 675db6bc1e
commit ef9be0f897
7 changed files with 566 additions and 9 deletions
@@ -0,0 +1,128 @@
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [Parameter(Mandatory)]
+    [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9.-]*$')]
+    [string]$DomainName,
+
+    [Parameter(Mandatory)]
+    [ValidatePattern('^[A-Za-z0-9][A-Za-z0-9.-]*$')]
+    [string]$ServerAddress,
+
+    [Parameter(Mandatory)]
+    [ValidatePattern('^[A-Za-z0-9+/=]+$')]
+    [string]$ServerPublicKey,
+
+    [string]$RegistrationShareName = 'SGU-RustDesk-Enrollment$',
+    [string]$DataRoot = "$env:ProgramData\SGU\RustDesk\LinuxEnrollment",
+    [string]$ProcessorScriptPath = (Join-Path $PSScriptRoot 'Invoke-SguRustDeskLinuxRegistrationProcessor.ps1')
+)
+
+$ErrorActionPreference = 'Stop'
+
+function Assert-Administrator {
+    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+    $principal = [Security.Principal.WindowsPrincipal]::new($identity)
+    if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+        throw 'Only a local administrator can install Linux RustDesk enrollment.'
+    }
+}
+
+function Get-EnrollmentCertificate {
+    param([Parameter(Mandatory)][string]$FriendlyName)
+
+    $certificate = Get-ChildItem -Path Cert:\LocalMachine\My |
+        Where-Object FriendlyName -eq $FriendlyName |
+        Where-Object HasPrivateKey |
+        Select-Object -First 1
+    if (-not $certificate) {
+        $certificate = New-SelfSignedCertificate `
+            -Subject 'CN=SGU RustDesk Linux enrollment' `
+            -FriendlyName $FriendlyName `
+            -CertStoreLocation 'Cert:\LocalMachine\My' `
+            -KeyAlgorithm RSA `
+            -KeyLength 3072 `
+            -KeyUsage KeyEncipherment,DigitalSignature `
+            -NotAfter (Get-Date).AddYears(5)
+    }
+    return $certificate
+}
+
+function Set-EnrollmentDirectoryAcl {
+    param(
+        [Parameter(Mandatory)][string]$Path,
+        [Parameter(Mandatory)][string]$DomainNetbiosName
+    )
+
+    New-Item -ItemType Directory -Path $Path -Force | Out-Null
+    $arguments = @(
+        "`"$Path`"", '/inheritance:r',
+        '/grant:r', 'SYSTEM:(OI)(CI)(F)',
+        'BUILTIN\Administrators:(OI)(CI)(F)',
+        "$DomainNetbiosName\Domain Computers:(OI)(CI)(M)"
+    )
+    & icacls.exe @arguments | Out-Null
+    if ($LASTEXITCODE -ne 0) {
+        throw "Could not secure the Linux RustDesk enrollment directory $Path."
+    }
+}
+
+Assert-Administrator
+Import-Module ActiveDirectory -ErrorAction Stop
+if (-not (Test-Path -LiteralPath $ProcessorScriptPath -PathType Leaf)) {
+    throw "The Linux RustDesk registration processor is missing: $ProcessorScriptPath"
+}
+if (-not $PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Install the protected Linux RustDesk enrollment endpoint')) {
+    return
+}
+
+$domain = Get-ADDomain -Identity $DomainName
+$publicRoot = Join-Path $DataRoot 'Public'
+$requestsRoot = Join-Path $publicRoot 'Requests'
+$archiveRoot = Join-Path $publicRoot 'Archive'
+$rejectedRoot = Join-Path $publicRoot 'Rejected'
+foreach ($path in @($DataRoot, $publicRoot, $requestsRoot, $archiveRoot, $rejectedRoot)) {
+    Set-EnrollmentDirectoryAcl -Path $path -DomainNetbiosName $domain.NetBIOSName
+}
+
+$certificate = Get-EnrollmentCertificate -FriendlyName 'SGU RustDesk Linux enrollment'
+$publicCertificatePath = Join-Path $publicRoot 'registration-public.cer'
+Export-Certificate -Cert $certificate -FilePath $publicCertificatePath -Force | Out-Null
+$clientConfiguration = [ordered]@{
+    ServerAddress = $ServerAddress
+    ServerPublicKey = $ServerPublicKey
+    RegistrationShare = "\\$env:COMPUTERNAME\$RegistrationShareName"
+    UpdatedAt = (Get-Date).ToString('o')
+}
+[IO.File]::WriteAllText((Join-Path $publicRoot 'rustdesk-client.json'),
+    ($clientConfiguration | ConvertTo-Json), [Text.UTF8Encoding]::new($false))
+
+$share = Get-SmbShare -Name $RegistrationShareName -ErrorAction SilentlyContinue
+if (-not $share) {
+    New-SmbShare -Name $RegistrationShareName -Path $publicRoot `
+        -FullAccess @('SYSTEM', 'BUILTIN\Administrators') `
+        -ChangeAccess "$($domain.NetBIOSName)\Domain Computers" | Out-Null
+}
+elseif ($share.Path -ne $publicRoot) {
+    throw "The existing SMB share $RegistrationShareName points to $($share.Path), not $publicRoot."
+}
+
+$installedProcessor = Join-Path $DataRoot 'Invoke-SguRustDeskLinuxRegistrationProcessor.ps1'
+Copy-Item -LiteralPath $ProcessorScriptPath -Destination $installedProcessor -Force
+$processorArguments = "-NoProfile -NonInteractive -ExecutionPolicy Bypass -File `"$installedProcessor`" -DataRoot `"$DataRoot`" -CertificateThumbprint $($certificate.Thumbprint)"
+$action = New-ScheduledTaskAction -Execute (Join-Path $env:WINDIR 'System32\WindowsPowerShell\v1.0\powershell.exe') `
+    -Argument $processorArguments
+$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) `
+    -RepetitionInterval (New-TimeSpan -Minutes 1) -RepetitionDuration (New-TimeSpan -Days 3650)
+$principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
+Register-ScheduledTask -TaskName 'SGU-RustDesk-LinuxRegistration' -Action $action -Trigger $trigger `
+    -Principal $principal -Description 'Registers encrypted RustDesk credentials sent by domain-joined Linux computers.' -Force | Out-Null
+
+New-NetFirewallRule -DisplayName 'SGU RustDesk Linux enrollment SMB' -Group 'SGU RustDesk' `
+    -Direction Inbound -Action Allow -Protocol TCP -LocalPort 445 -Profile Domain -ErrorAction SilentlyContinue | Out-Null
+
+[pscustomobject]@{
+    RegistrationShare = "\\$env:COMPUTERNAME\$RegistrationShareName"
+    PublicCertificatePath = $publicCertificatePath
+    RegistrationTask = 'SGU-RustDesk-LinuxRegistration'
+    CertificateThumbprint = $certificate.Thumbprint
+}