CODEWITHSUNDEEP
windowsauthorizationansiblekerberos
alexfvolk
alexfvolk

Reputation: 1830

How to run ansible from linux to deploy on windows machines

Here is what I have after setting kerberos according to ansible: http://docs.ansible.com/ansible/intro_windows.html

[libdefaults]
        default_realm = MY.DOMAIN.COM
…
[realms]
        MY.DOMAIN.COM = {
                default_domain = my.domain.com
                kdc = <domain-controller-server>.my.domain.com
                kpasswd_server = <domain-controller-server>.my.domain.com
        }
…
[domain_realm]
        .my.domain.com = MY.DOMAIN.COM
…

I was able to create a kerberos ticket, here is my output:

root@alex-VirtualBox:/etc/ansible# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: <user_name>@MY.DOMAIN.COM

Valid starting       Expires              Service principal
04/07/2016 13:58:52  04/07/2016 23:58:52  krbtgt/[email protected]
       renew until 04/08/2016 13:58:48
04/07/2016 14:02:20  04/07/2016 23:58:52  HTTP/<windows-target-server>[email protected]
       renew until 04/08/2016 13:58:48

So what I am trying to do is run ansible playbook or even a simple command on . But I am getting this error which I am pretty sure have nothing to do with ansible:

root@alex-VirtualBox:/etc/ansible# ansible windows -m win_ping --ask-vault-pass
Vault password: 
<windows-target-server>.my.domain.com | FAILED! => {
        "failed": true, 
        "msg": "kerberos: (('Unspecified GSS failure.  Minor code may provide more information', 851968), ('Server not found in Kerberos database', -1765328377)), plaintext: 401 Unauthorized."
    }

I even went ahead and created the keytab file:

> ktutil
  ktutil:  addent -password -p <user_name>@MY.DOMAIN.COM -k 1 -e rc4-hmac
  provide password
  ktutil:  wkt <user_name>.keytab
  ktutil:  quit

But then I get different error:

root@alex-VirtualBox:/etc/ansible# ansible windows -m win_ping --ask-vault-pass
n2-2wbp-wbsvr01.na.msds.rhi.com | FAILED! => {
    "failed": true, 
    "msg": "kerberos: (('An invalid name was supplied', 131072), ('Success', 100001)), plaintext: 401 Unauthorized."
}

Upvotes: 0

Views: 1541

Answers (1)

Valeriy Solovyov
Valeriy Solovyov

Reputation: 5648

Try to put the IP and Hostname of your Windows Host entry in /etc/hosts file and then try: https://github.com/diyan/pywinrm/issues/21#issuecomment-58958732 , https://github.com/diyan/pywinrm/issues/21#issuecomment-59084178

PS: 'Server not found in Kerberos database' - That usually means that the Linux host where you're running kinit is not joined to the domain (ie, it doesn't have a properly configured computer account in the domain). The existing docs unhelpfully omit that requirement...

Upvotes: 1

Related Questions