Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Using Ansible on windows with domain user

I'm starting to learn Ansible but the documentation is not too helpful.

I have installed the control machine on RHEL and created the necessary hosts file and windows.yml.

But when trying to connect to the remote Windows server to get a pong back I get the following error:

[root@myd666 ansible_test]# ansible windows -i hosts -m win_ping
hostname | UNREACHABLE! => {
    "changed": false,
    "msg": "ssl: the specified credentials were rejected by the server",
    "unreachable": true
}

After Installing python-kerberos dependencies,

I now get this Error:

hostname | UNREACHABLE! => {
    "changed": false,
    "msg": "Kerberos auth failure: kinit: KDC reply did not match expectations while getting initial credentials",
    "unreachable": true
}

My windows.yml file contains:

# it is suggested that these be encrypted with ansible-vault:
# ansible-vault edit group_vars/windows.yml
ansible_ssh_user: [email protected]
ansible_ssh_pass: password
ansible_ssh_port: 5986
ansible_connection: winrm
ansible_winrm_server_cert_validation: ignore

Am I doing anything wrong with the syntax of Domain\user? Maybe I forgot to install something on the Windows machine? I only ran the ConfigureRemotingForAnsible.ps1 script, and Python is not installed there.

This is my krb5.conf file:

[libdefaults]
default_realm = MYDOMAIN.NET
#dns_lookup_realm = true
#dns_lookup_kdc = true

[realms]
MYDOMAIN.NET = {
kdc = dc1.mydomain.net
default_domain = hpeswlab.net
}

[domain_realm]
.mydomain.net = MYDOMAIN.NET
 mydomain.net = MYDOMAIN.NET

And I do get a token using Kinit:

kinit -C [email protected]

klist

Klist output:

Valid starting       Expires              Service principal
01/31/2017 11:25:33  01/31/2017 21:25:33  krbtgt/[email protected]
        renew until 02/01/2017 11:25:29
like image 578
Shahar Hamuzim Rajuan Avatar asked Jan 29 '17 15:01

Shahar Hamuzim Rajuan


People also ask

Can Ansible run on Windows host natively?

No, Ansible can only manage Windows hosts. Ansible cannot run on a Windows host natively, though it can run under the Windows Subsystem for Linux (WSL).

Can I run Ansible from Windows?

No, Ansible cannot run on a Windows host and can only manage Windows hosts, but Ansible can be run under the Windows Subsystem for Linux (WSL). The Windows Subsystem for Linux is not supported by Microsoft or Ansible and should not be used for production systems.

Can we use Ansible for Windows Server?

Ansible can manage desktop OSs including Windows 8.1, and 10, and server OSs including Windows Server 2012, 2012 R2, 2016, 2019, and 2022. Ansible requires PowerShell 3.0 or newer and at least . NET 4.0 to be installed on the Windows host.


1 Answers

In windows.yml, please double-check and ensure that the ansible_ssh_user: [email protected] line does indeed have the realm MYDOMAIN.NET in upper case. Somewhere, the realm request to the KDC is being sent in lower case instead of upper case causing the 'KDC reply did not match expectations..' error.

In krb5.conf, case-sensitivity is also important. First I'll note that since the KDC name is the name of an IP host, so it needs to be specified as a fully-qualified host name, like in the example shown below. It assumes your KDC is named "dc1.mydomain.net". Next, the domain name should only be in lower case. On the other hand, Kerberos Realm names need be in upper case - if the realm name is incorrectly specified in lower case in this file that is another reason you may get this error message. Please modify your entire krb5.conf to look like that shown below (changing only "dc1" to the actual name) and it should work. Side note: You do not necessarily need the two dns_lookup_ lines in your krb5.conf, so please comment them out per the below. Those are fallback mechanisms only as per the MIT Kerberos Documentation and may actually cause issues in your simple use case. After modifying either configuration file, make sure to restart the Ansible engine before testing again.

[libdefaults]
default_realm = MYDOMAIN.NET
#dns_lookup_realm = true
#dns_lookup_kdc = true

[realms]
MYDOMAIN.NET = {
kdc = dc1.mydomain.net
default_domain = mydomain.net
        }

[domain_realm]
.mydomain.net = MYDOMAIN.NET 
mydomain.net = MYDOMAIN.NET

Please refer to this MIT reference for how to properly set up the krb5.conf: Sample krb5.conf File

In the Hosts file, check to ensure your IP to name mappings are correct. Per the RFCs, Kerberos requires a properly functioning DNS, and you are at risk of shortchanging that if your Hosts file has outdated entries in it.

Finally, though I wasn't able to tell which version of Ansible you were using, I did some research and found that "Ansible 2.0 has deprecated the “ssh” from ansible_ssh_user, ansible_ssh_host, and ansible_ssh_port to become ansible_user, ansible_host, and ansible_port." This could certainly be part of the problem. See: Ansible on Windows Documentation

like image 185
T-Heron Avatar answered Sep 19 '22 14:09

T-Heron