Estou iniciando meus estudos com Ansible e queria aplicá-lo em uma situação real do meu trabalho. Estou implementando o Ansible do Ubuntu para gerenciar um Windows Nano Server 2016. Estou configurando para usar um certificado mapeado para uma conta de usuário. Baseei este tutorial aquihttps://adamtheautomator.com/winrm-https-ansible/
O erro
Testei a conexão usando o módulo win_ping e recebi esta saída:
**ansible windows -vvvv -i hosts -m win_ping**
NanoServer | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: OpenSSH_8.2p1 Ubuntu-4ubuntu0.1, OpenSSL 1.1.1f 31 Mar 2020
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for
*debug1: auto-mux: Trying existing master
debug1: Control socket \"/home/woliveira/.ansible/cp/6df2d837bc\" does not exist
debug2: resolving \"nanoserver\" port 5986
debug2: ssh_connect_direct
debug1: Connecting to nanoserver [10.11.39.250] port 5986.
debug2: fd 3 setting O_NONBLOCK
debug1: fd 3 clearing O_NONBLOCK
debug1: Connection established.
debug3: timeout: 25000 ms remain after connect
debug1: identity file /home/woliveira/.ssh/id_rsa type -1
debug1: identity file /home/woliveira/.ssh/id_rsa-cert type -1
debug1: identity file /home/woliveira/.ssh/id_dsa type -1
debug1: identity file /home/woliveira/.ssh/id_dsa-cert type -1
debug1: identity file /home/woliveira/.ssh/id_ecdsa type -1
debug1: identity file /home/woliveira/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/woliveira/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/woliveira/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/woliveira/.ssh/id_ed25519 type -1
debug1: identity file /home/woliveira/.ssh/id_ed25519-cert type -1
debug1: identity file /home/woliveira/.ssh/id_ed25519_sk type -1
debug1: identity file /home/woliveira/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/woliveira/.ssh/id_xmss type -1
debug1: identity file /home/woliveira/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1
**Connection timed out during banner exchange",
"unreachable": true**
}
Em seguida, tentei aumentar o tempo limite no arquivo de configuração ansible e recebi uma redefinição de conexão por peer.
NanoServer | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: OpenSSH_8.2p1 Ubuntu-4ubuntu0.1, OpenSSL 1.1.1f 31 Mar 2020
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for
*debug1: auto-mux: Trying existing master
debug1: Control socket \"/home/woliveira/.ansible/cp/6df2d837bc\" does not exist
debug2: resolving \"nanoserver\" port 5986
debug2: ssh_connect_direct
debug1: Connecting to nanoserver [10.11.39.250] port 5986.
debug2: fd 3 setting O_NONBLOCK
debug1: fd 3 clearing O_NONBLOCK
debug1: Connection established.
debug3: timeout: 3600000 ms remain after connect
debug1: identity file /home/woliveira/.ssh/id_rsa type -1
debug1: identity file /home/woliveira/.ssh/id_rsa-cert type -1
debug1: identity file /home/woliveira/.ssh/id_dsa type -1
debug1: identity file /home/woliveira/.ssh/id_dsa-cert type -1
debug1: identity file /home/woliveira/.ssh/id_ecdsa type -1
debug1: identity file /home/woliveira/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/woliveira/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/woliveira/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/woliveira/.ssh/id_ed25519 type -1
debug1: identity file /home/woliveira/.ssh/id_ed25519-cert type -1
debug1: identity file /home/woliveira/.ssh/id_ed25519_sk type -1
debug1: identity file /home/woliveira/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/woliveira/.ssh/id_xmss type -1
debug1: identity file /home/woliveira/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1
kex_exchange_identification: read: **Connection reset by peer",
"unreachable": true**
}
A configuração do ambiente.
OAnsible 2.9.6 está instalado em um Ubuntu 20.04.1LTSVM
Meu servidor Windows é o seguinte: Nome do sistema operacional: Avaliação padrão do Microsoft Windows Server 2016 Versão do sistema operacional: 10.0.14393 N/A Build 14393
Ambas as VMs possuem IP estático e não estão em um domínio. Eu sigo este tutorial: https://vnuggets.com/2019/08/08/ansible-certificate-authentication-to-windows/
Criei um usuário local do Windows chamado ansibleoperator e adicionei esse usuário no Local Admi Group. Este é meu arquivo de hosts Ansible:
[windows]
NanoServer
[windows:vars]
ansible_user=ansibleoperator
ansible_password=*********
ansble_connection=winrm
ansible_winrm_cert_pem=/home/woliveira/cert.pem
ansible_winrm_cert_key_pem=/home/woliveira/cert_key.pem
ansible_port=5986
ansible_winrm_scheme=https
ansible_winrm_server_cert_validation=ignore
O firewall do Windows está desabilitado TrustedHosts está configurado para qualquer host (valor=*)
O que eu verifiquei
Se outro host Windows conseguir se conectar usando winrm: PS C:> Test-WSMan -ComputerName "NanoServer" -UseSSL
wsmid : http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd
ProtocolVersion : http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd
ProductVendor : Microsoft Corporation
ProductVersion : OS: 0.0.0 SP: 0.0 Stack: 3.0
Do lado do Linux posso usar o Netcat para testar a conexão na porta 5986 usando o seguinte comando:
nc -z -w1 NanoServer 5986;echo $?
A saída é 0 (comando bem-sucedido)
Já tentei me conectar de outro Windows, mas desta vez usando o script pywinrm, pois é a mesma biblioteca que o Ansible usa. Eu executo este script:
import winrm
cert_pem = 'C:/Users/woliveira.adm/Desktop/CertificadoAnsible/cert.pem'
cert_key_pem = 'C:/Users/woliveira.adm/Desktop/CertificadoAnsible/cert_key.pem'
session = winrm.Session('NanoServer:5986', auth=('ansibleoperator', '********'),
transport='certificate',
cert_pem=cert_pem,
cert_key_pem=cert_key_pem,
server_cert_validation='ignore',
)
session.run_cmd('ipconfig')
E receba isto:
Traceback (most recent call last):
File "<ipython-input-56-b902c730fb9c>", line 1, in <module>
runfile('C:/Users/woliveira.adm/Desktop/testewinrm.py', wdir='C:/Users/woliveira.adm/Desktop')
File "C:\ProgramData\Anaconda3\lib\site-packages\spyder_kernels\customize\spydercustomize.py", line 786, in runfile
execfile(filename, namespace)
File "C:\ProgramData\Anaconda3\lib\site-packages\spyder_kernels\customize\spydercustomize.py", line 110, in execfile
exec(compile(f.read(), filename, 'exec'), namespace)
File "C:/Users/woliveira.adm/Desktop/testewinrm.py", line 19, in <module>
session.run_cmd('ipconfig')
File "C:\ProgramData\Anaconda3\lib\site-packages\winrm\__init__.py", line 39, in run_cmd
shell_id = self.protocol.open_shell()
File "C:\ProgramData\Anaconda3\lib\site-packages\winrm\protocol.py", line 166, in open_shell
res = self.send_message(xmltodict.unparse(req))
File "C:\ProgramData\Anaconda3\lib\site-packages\winrm\protocol.py", line 243, in send_message
resp = self.transport.send_message(message)
File "C:\ProgramData\Anaconda3\lib\site-packages\winrm\transport.py", line 323, in send_message
response = self._send_message_request(prepared_request, message)
File "C:\ProgramData\Anaconda3\lib\site-packages\winrm\transport.py", line 328, in _send_message_request
response = self.session.send(prepared_request, timeout=self.read_timeout_sec)
File "C:\ProgramData\Anaconda3\lib\site-packages\requests\sessions.py", line 646, in send
r = adapter.send(request, **kwargs)
File "C:\ProgramData\Anaconda3\lib\site-packages\requests\adapters.py", line 529, in send
raise ReadTimeout(e, request=request)
ReadTimeout: HTTPConnectionPool(host='10.11.39.250', port=5986): Read timed out. (read timeout=30)
Não sei como poderia depurar isso. O que eu poderia verificar?
Desculpe meu ingles. Se houver algo que não esteja claro o suficiente, por favor me avise.
Responder1
Você cometeu um erro de digitação no seu arquivo vars:
ansble_connection=winrm
Isso deve ser:
ansible_connection=winrm
(há uma ifalta).
É por isso que o Ansible está tentando se conectar via SSH em vez de WinRM.