ansible_ssh_user and ansible_ssh_pass in windows.yml

Archives Ansible Project
1

Details:
Ansible 1.8
CentOs 7
Windows 7 (not a server os)

Documentation specifies that for remote nodes running windows we add these definitions to /etc/ansible/group_vars/windows.yml

ansible_ssh_user: Administrator
ansible_ssh_pass: SekritPasswordGoesHere
ansible_ssh_port: 5986
ansible_connection: winrm

So does user and pass above refer to the local linux account on the management node or the local windows account on the remote node (windows 7) or is it just part of ansible-vault or something else all together?  I think it would have to be the management node account or else if you had 100 remote nodes you would need 100 names and passwords.  Am I understanding this correctly?  Could someone clarify for me?
2

It will be the remote nodes. In lots of cases these are all the same
(lots of setups have the same management account with the same
credentials on the managed nodes). And if you need to specify per-host
variables for the remote nodes you can do that as well in your
inventory.

3

It is the username/password combination for the remote nodes (in your case the windows nodes).

You can also configure them in host_vars, or potentially in a dynamic inventory script that pulls that info from a CMDB or database.

4

So then when I run ansible with the --ask-pass switch and it asks me for SSH password, ansible_ssh_pass is the password they want or is that a different password.

5

–ask-pass is the equivalent of specifying a single password for all remote nodes with ansible_ssh_pass.

6

Okay this is fixed. The values assigned to the variables “ansible_ssh_user” and “ansible_ssh_pass” must:

  1. Exactly match an account on the windows machine with admin privileges (account must exist but need NOT be current active login)

  2. If you are using SSL and the value of winrm/config/service/AllowUnencrypted is true (this is the default) the values in ansible\group_vars\windows.yml must exactly match the username and password that was submitted to generate the SSL web certificate.

In my case I also had to append the computer name with the port number in the inventory like this

[windows]
ComputerName:5986

(or 5985 for AllowUnedcrypted=“true” type this command in powershell PS C:\winrm set winrm/config/service ‘@{AllowUnencrypted=“true”}’

done.