# Error while doing kerbrose connection from Ansible to Windows

**URL:** <https://forum.ansible.com/t/error-while-doing-kerbrose-connection-from-ansible-to-windows/22088>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [July 22, 2016, 12:41pm UTC](https://forum.ansible.com/t/error-while-doing-kerbrose-connection-from-ansible-to-windows/22088 "2016-07-22T12:41:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![manoj\_kumar1](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@manoj\_kumar1](https://forum.ansible.com/u/manoj_kumar1)\
**Post date:** [July 22, 2016, 12:41pm UTC](https://forum.ansible.com/t/error-while-doing-kerbrose-connection-from-ansible-to-windows/22088/1 "2016-07-22T12:41:43Z")

</div>

Hi,

I have ansible version

**ansible 2.1.0.0**  
**config file = /etc/ansible/ansible.cfg**  
**configured module search path = Default w/o overrides**

Kerberos is also installled along with request\_kerberose and pywinrm0.2.0.

I am getting the error while running a ping module as " **“changed”: false,**  
**“msg”: “kerberos: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377))”,**  
**“unreachable”: true**  
"  
Host file is like

**[server]**  
**[BCDFPO91.PAL.COM](http://BCDFPO91.PAL.COM)**

**[server:vars]**  
**[ansible\_user=USER@PAL.COM](mailto:ansible_user=USER@PAL.COM)**  
**ansible\_ssh\_pass=0987**  
**ansible\_connection=winrm**  
**ansible\_port=5986**  
**ansible\_winrm\_transport=kerberos**  
**ansible\_winrm\_kerberos\_delegation=yes**

Can you guys please help out what needs to be done to resolve this.

BR  
Manoj

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [July 22, 2016, 2:20pm UTC](https://forum.ansible.com/t/error-while-doing-kerbrose-connection-from-ansible-to-windows/22088/2 "2016-07-22T14:20:34Z")

</div>

Not sure what is wrong but kerberos needs DNS to work fully (both forward and reverse lookups).

Check the hostname can be resolved to an ip from your ansible controller.

Also check you have configured correct domain controllers in your /etc/krb5.conf

Hope this helps,

Jon

---

<div class="post-metadata">

**Author:** ![manoj\_kumar1](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@manoj\_kumar1](https://forum.ansible.com/u/manoj_kumar1)\
**Post date:** [July 25, 2016, 9:36am UTC](https://forum.ansible.com/t/error-while-doing-kerbrose-connection-from-ansible-to-windows/22088/3 "2016-07-25T09:36:45Z")

</div>

Host name is resolvable to an IP. But while resolving IP back for testing reverse DNS mapping it is not happening.

In /etc/krb5.conf we have the correct configuration as below.

```auto
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = WEBSITE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 WEBSITE.COM = {
  kdc = WIN-SA2TXZOTVMV.website.com
  admin_server = WIN-SA2TXZOTVMV.website.com
 }

[domain_realm]
 .website.com = WEBSITE.COM
 website.com = WEBSITE.COM

```

Also I am getting connected to the domain using **kinit.**

But the servers are not getting recognized. with the error "traceroute [AMATLTDMSWEB00.RECALL.COM](http://AMATLTDMSWEB00.RECALL.COM)  
[AMATLTDMSWEB00.RECALL.COM](http://AMATLTDMSWEB00.RECALL.COM): Name or service not known  
Cannot handle “host” cmdline arg `[AMATLTDMSWEB00.RECALL.COM](http://AMATLTDMSWEB00.RECALL.COM)’ on position 1 (argc 1)  
"

While using servername/ip in the hosts file and tries to getting conencted the below mentioned error comes up.

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [July 26, 2016, 5:44am UTC](https://forum.ansible.com/t/error-while-doing-kerbrose-connection-from-ansible-to-windows/22088/4 "2016-07-26T05:44:28Z")

</div>

Your krb5.conf looks ok, although you might want to add a second kdc machine if you have one. Looks like that side of things is working if you are getting a kerberos ticket ok.

Pretty certain you are going to need to get reverse DNS lookups functioning properly to get kerberos connections working though.  
Its worth doing as less than fully functional DNS just makes life difficult for network users. Unfortunately its something I have no experience of fixing so don’t know how to help with that.

If you are just using hostnames in your inventory, check that the search suffixes are set up correctly in your resolv.conf

Jon