# CentOS 7 control server can't connect to Windows with kerberos **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [April 19, 2017, 8:47pm UTC](https://forum.ansible.com/t/centos-7-control-server-cant-connect-to-windows-with-kerberos/24253 "2017-04-19T20:47:38Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Mark\_Allison](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@Mark\_Allison](https://forum.ansible.com/u/Mark_Allison)\ **Post date:** [April 19, 2017, 8:47pm UTC](https://forum.ansible.com/t/centos-7-control-server-cant-connect-to-windows-with-kerberos/24253/1 "2017-04-19T20:47:38Z")
I’ve set up a new CentOS 7 VM and installed ansible fine and the kerberos components according to this guide [https://docs.ansible.com/ansible/intro\_windows.html#kerberos](https://docs.ansible.com/ansible/intro_windows.html#kerberos) I’ve done the following: Added the ansible control server Computer account to AD. Added a test windows machine into /etc/ansible/hosts (called wisteria.duck.loc) Created /etc/ansible/group\_vars/windows.yml with this text: ansible\_user: mark@DUCK.LOC ansible\_password: SecretPasswordGoesHere ansible\_port: 5986 ansible\_connection: winrm # The following is necessary for Python 2.7.9+ (or any older Python that has backported SSLContext, eg, Python 2.7.5 on RHEL7) when using default WinRM self-signed certificates: ansible\_winrm\_server\_cert\_validation: ignore Ran kinit and klist and it worked fine. [mark@carnation ansible]$ ansible --version ansible 2.2.1.0 config file = /etc/ansible/ansible.cfg configured module search path = Default w/o overrides [mark@carnation ansible]$ ansible windows -m win\_ping wisteria.duck.loc | UNREACHABLE! =\> { “changed”: false, “msg”: “kerberos: HTTPSConnectionPool(host=‘wisteria.duck.loc’, port=5986): Max retries exceeded with url: /wsman (Caused by NewConnectionError(‘\: Failed to establish a new connection: [Errno 111] Connection refused’,)), ssl: HTTPSConnectionPool(host=‘wisteria.duck.loc’, port=5986): Max retries exceeded with url: /wsman (Caused by NewConnectionError(‘\: Failed to establish a new connection: [Errno 111] Connection refused’,))”, “unreachable”: true } [mark@carnation ansible]$ Any ideas on next steps to troubleshoot? ---
**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\ **Post date:** [April 20, 2017, 5:41pm UTC](https://forum.ansible.com/t/centos-7-control-server-cant-connect-to-windows-with-kerberos/24253/2 "2017-04-20T17:41:55Z")
The “connection refused” error doesn’t have anything to do with Kerberos- WinRM is not answering on 5986. Have you run the ConfigureRemotingForAnsible.ps1 script on the target host (or taken manual steps) to set up an HTTPS WinRM listener? If so, I’d suspect a firewall or some other networking issue is part of the problem. I’d also suggest that you get things working with a local account and Basic auth first, as Kerberos can be a complicated beast to debug, and it sounds like you’ve got other problems to solve first that aren’t Kerb-related. -Matt ---
**Author:** ![Mark\_Allison](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@Mark\_Allison](https://forum.ansible.com/u/Mark_Allison)\ **Post date:** [April 24, 2017, 3:09pm UTC](https://forum.ansible.com/t/centos-7-control-server-cant-connect-to-windows-with-kerberos/24253/3 "2017-04-24T15:09:06Z")
Thanks Matt I created a local user on my target machine called ansible. Have not added it to any groups. I’ve changed /etc/ansible/group\_vars/windows.yml file to: ansible\_user: ansible ansible\_password: ans1bleUser ansible\_port: 5986 ansible\_connection: winrm ansible\_winrm\_server\_cert\_validation: ignore ansible\_winrm\_transport: Basic When I try and connect I get this error: [mark@carnation ~]$ ansible windows -m win\_ping wisteria.duck.loc | FAILED! =\> { “failed”: true, “msg”: “The installed version of WinRM does not support transport(s) [u’Basic’]” } Are there any tutorials you know of that shows you how to connect to Windows targets with the different authentication options? ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [April 24, 2017, 3:27pm UTC](https://forum.ansible.com/t/centos-7-control-server-cant-connect-to-windows-with-kerberos/24253/4 "2017-04-24T15:27:55Z")
Basic auth just means using a simple username and password to login. I suggest you remove the ansible\_winrm\_transport: Basic line from your configuration and try again. Hope this helps, Jon ---
**Author:** ![Mark\_Allison](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@Mark\_Allison](https://forum.ansible.com/u/Mark_Allison)\ **Post date:** [April 24, 2017, 7:31pm UTC](https://forum.ansible.com/t/centos-7-control-server-cant-connect-to-windows-with-kerberos/24253/5 "2017-04-24T19:31:05Z")
Thanks Jon, I did that and tried again and now get this: [mark@carnation ~]$ ansible windows -m win\_ping wisteria.duck.loc | UNREACHABLE! =\> { “changed”: false, “msg”: “ssl: the specified credentials were rejected by the server”, “unreachable”: true } ---
**Author:** ![Mark\_Allison](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@Mark\_Allison](https://forum.ansible.com/u/Mark_Allison)\ **Post date:** [April 24, 2017, 7:41pm UTC](https://forum.ansible.com/t/centos-7-control-server-cant-connect-to-windows-with-kerberos/24253/6 "2017-04-24T19:41:38Z")
I made the ansible user a member of local Administrators and then it worked [mark@carnation ~]$ ansible windows -m win\_ping wisteria.duck.loc | SUCCESS =\> { “changed”: false, “ping”: “pong” } Thanks for looking.