REQ 049

REQ-049: Enforced NTLM message encryption

Requirement

Windows WinRM provisioning shall require NTLM message encryption for the loopback-forwarded HTTP connection.

Rationale

Authentication without enforced message protection is insufficient for the selected management channel.

Fit Criterion

The guest denies unencrypted WSMan and disables Basic authentication; the client requires NTLM message encryption with no downgrade. An unprotected request is rejected and an encrypted, authenticated request succeeds.

Verification

Planned, TEST-049; the current guest permits unencrypted WSMan and Basic authentication.

Source

Software-Requirements-Specification

Priority

High

TestID

TEST-049

TestArtifact

Planned downgrade and protected-request tests

CodeRef

vm/windows-labview/winrm-setup-installer.nsi, provision-windows-guest.py

Status

Planned