# Ansible Kerboros authentication

**URL:** <https://forum.ansible.com/t/ansible-kerboros-authentication/36994>\
**Category:** Ansible Project\
**Created:** [August 16, 2022, 3:13pm UTC](https://forum.ansible.com/t/ansible-kerboros-authentication/36994 "2022-08-16T15:13:53Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nitrous](https://avatars.discourse-cdn.com/v4/letter/n/dfb087/32.png) [@Nitrous](https://forum.ansible.com/u/Nitrous)\
**Post date:** [August 16, 2022, 3:13pm UTC](https://forum.ansible.com/t/ansible-kerboros-authentication/36994/1 "2022-08-16T15:13:53Z")

</div>

Our ansible box isnt domain joined, and we build alot of VMs from a template, that has an account part of the image, that is local admin.

I was reading more into kerboros authentication, and setup my var file as this:

[xx:vars]  
ansible\_connection=winrm  
ansible\_user=xx  
ansible\_password=xx  
ansible\_port=5986  
ansible\_ssh\_port=5986  
ansible\_winrm\_transport=kerberos  
ansible\_winrm\_scheme=https  
ansible\_winrm\_server\_cert\_validation=ignore  
domain\_server=test.local  
domain\_username=cc  
domain\_password=cc  
wsus\_server=cc

When I run my playbook, I get:  
fatal: [x.x.x.x]: UNREACHABLE! =\> {  
“changed”: false,  
“msg”: “Kerberos auth failure when calling kinit cmd ‘kinit’: The command was not found or was not executable: kinit.”,  
“unreachable”: true  
}

My host file has the sever entry as below:

hostname ansible\_host=IP address of host

Changing the ansible\_winrm\_transport to basic works, with no issue.

How can I use my existing config to work with kerberos?

Please help/Suggest?

---

<div class="post-metadata">

**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\
**Post date:** [August 16, 2022, 3:50pm UTC](https://forum.ansible.com/t/ansible-kerboros-authentication/36994/2 "2022-08-16T15:50:48Z")

</div>

Your answer is in the error message.

“Kerberos auth failure when calling kinit cmd ‘kinit’: **The command was not found or was not executable: kinit.** ”

---

<div class="post-metadata">

**Author:** ![Nitrous](https://avatars.discourse-cdn.com/v4/letter/n/dfb087/32.png) [@Nitrous](https://forum.ansible.com/u/Nitrous)\
**Post date:** [August 16, 2022, 4:09pm UTC](https://forum.ansible.com/t/ansible-kerboros-authentication/36994/3 "2022-08-16T16:09:23Z")

</div>

Thanks, installed the kinit command, but now getting this error:

TASK [windowsupdates : Check If Windows Updates are Available] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
task path: /etc/ansible/roles/windowsupdates/tasks/main.yml:1  
The full traceback is:  
Traceback (most recent call last):  
File “/root/.ansible/collections/ansible\_collections/ansible/windows/plugins/action/win\_updates.py”, line 761, in run  
result = self.\_run\_sync(task\_vars, module\_options, reboot, reboot\_timeout)  
File “/root/.ansible/collections/ansible\_collections/ansible/windows/plugins/action/win\_updates.py”, line 834, in \_run\_sync  
update\_result = self.\_run\_updates(task\_vars, module\_options, poll\_script\_path, cancel\_script\_path)  
File “/root/.ansible/collections/ansible\_collections/ansible/windows/plugins/action/win\_updates.py”, line 907, in \_run\_updates  
output\_path, task\_pid, cancel\_id = self.\_start\_updates(task\_vars, module\_options)  
File “/root/.ansible/collections/ansible\_collections/ansible/windows/plugins/action/win\_updates.py”, line 951, in \_start\_updates  
raise \_ReturnResultException(msg, exception=result.get(‘exception’, None))  
ansible\_collections.ansible.windows.plugins.action.win\_updates.\_ReturnResultException: MODULE FAILURE  
See stdout/stderr for the exact error  
fatal: [ansible\_host=x.x.x.x]: FAILED! =\> {  
“changed”: false,  
“failed\_update\_count”: 0,  
“filtered\_updates”: {},  
“found\_update\_count”: 0,  
“installed\_update\_count”: 0,  
“msg”: “MODULE FAILURE\nSee stdout/stderr for the exact error”,  
“updates”: {}  
}  
…ignoring  
The full traceback is:  
Traceback (most recent call last):  
File “/root/.ansible/collections/ansible\_collections/ansible/windows/plugins/action/win\_updates.py”, line 761, in run  
result = self.\_run\_sync(task\_vars, module\_options, reboot, reboot\_timeout)  
File “/root/.ansible/collections/ansible\_collections/ansible/windows/plugins/action/win\_updates.py”, line 834, in \_run\_sync  
update\_result = self.\_run\_updates(task\_vars, module\_options, poll\_script\_path, cancel\_script\_path)  
File “/root/.ansible/collections/ansible\_collections/ansible/windows/plugins/action/win\_updates.py”, line 907, in \_run\_updates  
output\_path, task\_pid, cancel\_id = self.\_start\_updates(task\_vars, module\_options)  
File “/root/.ansible/collections/ansible\_collections/ansible/windows/plugins/action/win\_updates.py”, line 951, in \_start\_updates  
raise \_ReturnResultException(msg, exception=result.get(‘exception’, None))  
ansible\_collections.ansible.windows.plugins.action.win\_updates.\_ReturnResultException: MODULE FAILURE  
See stdout/stderr for the exact error  
fatal: [ansible\_host=x.x.x.x]: FAILED! =\> {  
“changed”: false,  
“failed\_update\_count”: 0,  
“filtered\_updates”: {},  
“found\_update\_count”: 0,  
“installed\_update\_count”: 0,  
“msg”: “MODULE FAILURE\nSee stdout/stderr for the exact error”,  
“updates”: {}  
}  
…ignoring

The same playbook works when using the basic authentication:

TASK [windowsupdates : Check If Windows Updates are Available] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
task path: /etc/ansible/roles/windowsupdates/tasks/main.yml:1  
ok: [hostname] =\> {  
“changed”: false,  
“failed\_update\_count”: 0,  
“filtered\_updates”: {},  
“found\_update\_count”: 0,  
“installed\_update\_count”: 0,  
“invocation”: {  
“module\_args”: {  
“accept\_list”: null,  
“category\_names”: [  
“Application”,  
“Connectors”,  
“DefinitionUpdates”,  
“FeaturePacks”,  
“Guidance”,  
“ServicePacks”,  
“Tools”,  
“UpdateRollups”,  
“CriticalUpdates”,  
“SecurityUpdates”,  
“Drivers”,  
“Updates”  
],  
“log\_path”: “C:\ansible\_wu.txt”,  
“reboot”: false,  
“reboot\_timeout”: 1200,  
“reject\_list”: null,  
“server\_selection”: “managed\_server”,  
“skip\_optional”: false,  
“state”: “searched”,  
“use\_scheduled\_task”: false  
}  
},  
“reboot\_required”: false,  
“updates”: {}  
}

---

<div class="post-metadata">

**Author:** ![Igor\_Turovsky](https://avatars.discourse-cdn.com/v4/letter/i/cdc98d/32.png) [@Igor\_Turovsky](https://forum.ansible.com/u/Igor_Turovsky)\
**Post date:** [August 16, 2022, 4:11pm UTC](https://forum.ansible.com/t/ansible-kerboros-authentication/36994/4 "2022-08-16T16:11:37Z")

</div>

It sounds like your ansible host does not have Krb5 library installed - [https://docs.ansible.com/ansible/latest/user\_guide/windows\_winrm.html#installing-the-kerberos-library](https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html#installing-the-kerberos-library).  
Also, Kerberos uses FQDNs vs ip addresses, so you will need to have dns names set as hostnames in inventory (or to use ansible\_winrm\_kerberos\_hostname\_override variable.)

вт, 16 авг. 2022 г. в 18:14, Nitrous \<[wassamashraf27@gmail.com](mailto:wassamashraf27@gmail.com)\>:

---

<div class="post-metadata">

**Author:** ![Nitrous](https://avatars.discourse-cdn.com/v4/letter/n/dfb087/32.png) [@Nitrous](https://forum.ansible.com/u/Nitrous)\
**Post date:** [August 16, 2022, 4:34pm UTC](https://forum.ansible.com/t/ansible-kerboros-authentication/36994/5 "2022-08-16T16:34:16Z")

</div>

I changed a few things, and now I see this:

TASK [windowsupdates : Check If Windows Updates are Available] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
task path: /etc/ansible/roles/windowsupdates/tasks/main.yml:1  
fatal: [ansible\_host=x.x.x.x]: UNREACHABLE! =\> {  
“changed”: false,  
“msg”: “Kerberos auth failure for principal xx@XX.LOCAL with pexpect: Cannot find KDC for realm " XX.LOCAL " while getting initial credentials”,  
“unreachable”: true  
}  
fatal: [ansible\_host=x.x.x.x]: UNREACHABLE! =\> {  
“changed”: false,  
“msg”: “Kerberos auth failure for principal xx@XX.LOCAL with pexpect: Cannot find KDC for realm " XX.LOCAL " while getting initial credentials”,  
“unreachable”: true  
}

My vars look like this :

ansible\_connection=winrm  
ansible\_user=xx@XX.LOCAL

ansible\_password=xx  
ansible\_winrm\_kerberos\_hostname\_override  
ansible\_port=5986

ansible\_ssh\_port=5986  
ansible\_winrm\_transport=kerberos  
ansible\_connection=local  
ansible\_winrm\_scheme=https  
ansible\_winrm\_server\_cert\_validation=ignore  
domain\_server=xx.local  
domain\_username=xx.local\xx  
domain\_password=xx

Host file looks like this:

ansible\_host=Ip add of the server

The ansible box isnt domain joined, and we have multiple domains.

---

<div class="post-metadata">

**Author:** ![Nitrous](https://avatars.discourse-cdn.com/v4/letter/n/dfb087/32.png) [@Nitrous](https://forum.ansible.com/u/Nitrous)\
**Post date:** [August 16, 2022, 4:48pm UTC](https://forum.ansible.com/t/ansible-kerboros-authentication/36994/6 "2022-08-16T16:48:29Z")

</div>

Even a simple playbook for ping fails, but using basic authentication, works:

TASK [ping] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
task path: /etc/ansible/playbooks/multiple.yml:8  
fatal: [ansible\_host=x.x.x.x]: FAILED! =\> {  
“changed”: false,  
“module\_stderr”: “/bin/sh: 1: powershell: not found\n”,  
“module\_stdout”: “”,  
“msg”: “The module failed to execute correctly, you probably need to set the interpreter.\nSee stdout/stderr for the exact error”,  
“rc”: 127  
}

---

<div class="post-metadata">

**Author:** ![Nitrous](https://avatars.discourse-cdn.com/v4/letter/n/dfb087/32.png) [@Nitrous](https://forum.ansible.com/u/Nitrous)\
**Post date:** [August 16, 2022, 5:11pm UTC](https://forum.ansible.com/t/ansible-kerboros-authentication/36994/7 "2022-08-16T17:11:41Z")

</div>

Also, just checked krb5.conf file :

[libdefaults]  
default\_realm = [PRIMARYDOMAIN.COM](http://PRIMARYDOMAIN.COM)

# The following krb5.conf variables are only for MIT Kerberos.

kdc\_timesync = 1  
ccache\_type = 4  
forwardable = true  
proxiable = true

# The following encryption type specification will be used by MIT Kerberos

# if uncommented. In general, the defaults in the MIT Kerberos code are

# correct and overriding these specifications only serves to disable new

# encryption types as they are added, creating interoperability problems.

---

<div class="post-metadata">

**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\
**Post date:** [August 16, 2022, 6:41pm UTC](https://forum.ansible.com/t/ansible-kerboros-authentication/36994/8 "2022-08-16T18:41:49Z")

</div>

If you join your Linux machine to AD with SSSD, this all gets filled in for you. Might make life easier.

Walter

---

<div class="post-metadata">

**Author:** ![Nitrous](https://avatars.discourse-cdn.com/v4/letter/n/dfb087/32.png) [@Nitrous](https://forum.ansible.com/u/Nitrous)\
**Post date:** [August 17, 2022, 1:51pm UTC](https://forum.ansible.com/t/ansible-kerboros-authentication/36994/9 "2022-08-17T13:51:32Z")

</div>

Yes thanks, we dont want to do that due to some restrictions, so hence asking for help 🙂

---

<div class="post-metadata">

**Author:** ![Luca\_remix\_tj\_Lorenz](https://avatars.discourse-cdn.com/v4/letter/l/ea666f/32.png) [@Luca\_remix\_tj\_Lorenz](https://forum.ansible.com/u/Luca_remix_tj_Lorenz)\
**Post date:** [August 17, 2022, 1:55pm UTC](https://forum.ansible.com/t/ansible-kerboros-authentication/36994/10 "2022-08-17T13:55:28Z")

</div>

Hello,

without joining to the domain, we added entries to krb5.conf to specify which are the kerberos servers to contact for authentication. So we specified credentials via the command line for ansible and we can authenticate to winrm successfully.

Luca

---

<div class="post-metadata">

**Author:** ![Nitrous](https://avatars.discourse-cdn.com/v4/letter/n/dfb087/32.png) [@Nitrous](https://forum.ansible.com/u/Nitrous)\
**Post date:** [August 17, 2022, 2:05pm UTC](https://forum.ansible.com/t/ansible-kerboros-authentication/36994/11 "2022-08-17T14:05:31Z")

</div>

Thanks, would you mind posting a sample of your krb5.conf file?

We have multiple domains, some domains dont have a trust relationship, so trying to figure out, how to do this in a manner, that works for all our domains.