# Help with psrp in ansible 2.7 **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [September 12, 2018, 4:06pm UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561 "2018-09-12T16:06:35Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Gil\_Shinar](https://avatars.discourse-cdn.com/v4/letter/g/8e8cbc/32.png) [@Gil\_Shinar](https://forum.ansible.com/u/Gil_Shinar)\ **Post date:** [September 12, 2018, 4:06pm UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/1 "2018-09-12T16:06:35Z")
I have installed ansible 2.7 rc1 because I need a way to install stuff on a windows machine via Linux server as a tunnel. After reading and trial and error, I have realized that it cannot be done using WinRM but only using psrp with ansible 2.7. I’m not sure what should be configured in the ansible\_psrp\_proxy parameter and how can ansible know that the tunnel is server is a Linux one that needs to connect using ssh. I have tried to configure the ansible.cfg to read a ssh.cfg file with the following content: Host ProxyCommand ssh -W %h:%p ec2-user@ IdentityFile Host bastion Hostname User ec2-user IdentityFile ForwardAgent yes ControlMaster auto ControlPath ~/.ssh/ansible-%r@%h:%p ControlPersist 5m Error message looks like that: ConnectTimeout: HTTPSConnectionPool(host=‘’, port=5986): Max retries exceeded with url: /wsman (Caused by ConnectTimeoutError(\, u’Connection to timed out. (connect timeout=30)')) 54.227.79.55 | FAILED! =\> { “msg”: “Unexpected failure during module execution.”, “stdout”: “” } Don’t know which protocol it uses to connect to the Linux server but I assume it is not ssh. Thanks Gil ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [September 12, 2018, 7:47pm UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/2 "2018-09-12T19:47:42Z")
The psrp connection plugin is similar to winrm and uses the same underlying protocol (http) to connect to hosts. The ansible\_psrp\_proxy variable can be used to specify a HTTP proxy to a server in the form of a URL. This can’t be used to tunnel traffic through SSH unfortunately. Thanks Jordan ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [September 12, 2018, 11:55pm UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/3 "2018-09-12T23:55:25Z")
Slight amendment to the above, I haven’t tested it but the underlying library behind psrp uses requests to send each HTTP requests and that is also meant to support SOCKS. It requires that you have installed PySocks through ‘pip install requests[socks]’ and then configure the ‘ansible\_psrp\_proxy’ value to be like ‘socks5://user:pass@host:port’. Thanks Jordan ---
**Author:** ![Gil\_Shinar](https://avatars.discourse-cdn.com/v4/letter/g/8e8cbc/32.png) [@Gil\_Shinar](https://forum.ansible.com/u/Gil_Shinar)\ **Post date:** [September 13, 2018, 5:27am UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/4 "2018-09-13T05:27:49Z")
Thanks, Jordan! So no plan to have an ssh tunnel to windows servers? If the above is true, I’ll need to rethink my AWS architecture or think of a different way to install the environment. Gil ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [September 13, 2018, 6:18am UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/5 "2018-09-13T06:18:50Z")
No explicit plans to natively support it in Ansible right now, I’ve heard people talking about chaining connections, e.g. use SSH to a host then WinRM from there but’s that quite complex and I don’t expect anything anytime soon. So while you can’t set all this up end to end with an inventory configuration you can still achieve what you want using a SOCKS proxy. Basically the only extra step needed to setup this proxy is to bind the local port and setup the SSH connection. Here is a very basic example of how to do all this, in my example I set up my local SSH connection to listen on port 12345 ` # install the requests socks dependency packages pip install requests[socks] # set up the following in your inventory [socks] windows-host [socks:vars] ansible\_user=username ansible\_password=password ansible\_connection=psrp ansible\_port=5985 # this is the port of the WinRM instance your Windows host is listening on ansible\_psrp\_proxy=socks5://localhost:12345 # in a separate terminal on your Ansible host run the following which will # start an SSH connection you need to keep active until you have finished with Ansible ```auto ssh -D 12345 username@bastionhost # now run your playbook ansible -i inventory.ini socks -m win_ping ``` ` I just tested this out and confirmed with Wireshark that there was no traffic over port 5985 to my host and the actual data was being sent over SSH to my bastion host and then from there it is sending the WinRM requests over port 5985. What happens in that example is that your localhost will setup an SSH connection that listens on port 12345 and any data received on that port will be tunneled to your bastion host. From the bastion host will then act as a client and send the WinRM request as per usual to the Windows host which it should have access to. Any responses are then tunneled back over the SSH connection and then finally sent back to Ansible to process. You can get tricky and play around with SSH to set up a ControlPath that you can use to run your SSH connection in the background and bring it up and down or even use a separate host to act as your SOCKS proxy and handle all the SSH connections but that’s a separate conversation from this. Thanks Jordan ---
**Author:** ![Gil\_Shinar](https://avatars.discourse-cdn.com/v4/letter/g/8e8cbc/32.png) [@Gil\_Shinar](https://forum.ansible.com/u/Gil_Shinar)\ **Post date:** [September 13, 2018, 7:27am UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/6 "2018-09-13T07:27:46Z")
Hi Jordan, First thanks a lot for the detailed description! I have tried the sock example but for some reason it does not work for me. I configured the inventory as you have suggested (changed user and pass), installed socks package (had some issues with pip but made it work with system pip), in a different terminal connected to my bastion (had to use -i ) and run the ansible command. Not sure were it fails: **ConnectionError: SOCKSHTTPConnectionPool(host=‘’, port=5985): Max retries exceeded with url: /wsman (Caused by NewConnectionError(‘\: Failed to establish a new connection: [Errno 111] Connection refused’,))** Any help would be appreciated Thanks Gil ---
**Author:** ![Gil\_Shinar](https://avatars.discourse-cdn.com/v4/letter/g/8e8cbc/32.png) [@Gil\_Shinar](https://forum.ansible.com/u/Gil_Shinar)\ **Post date:** [September 13, 2018, 7:38am UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/7 "2018-09-13T07:38:42Z")
Actually the error is a bit different: **ConnectTimeout: SOCKSHTTPConnectionPool(host=‘’, port=5985): Max retries exceeded with url: /wsman (Caused by ConnectTimeoutError(\, ‘Connection to timed out. (connect timeout=30)’))** ---
**Author:** ![Gil\_Shinar](https://avatars.discourse-cdn.com/v4/letter/g/8e8cbc/32.png) [@Gil\_Shinar](https://forum.ansible.com/u/Gil_Shinar)\ **Post date:** [September 13, 2018, 7:53am UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/8 "2018-09-13T07:53:43Z")
When I run tcmdump on the bastion, I see that it tries to connect to the windows host but does not get any response. When I try to directly connect to the windows machine using psrp it works just fine. ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [September 13, 2018, 10:57am UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/9 "2018-09-13T10:57:07Z")
Have you tried to connect from your bastion host to the Windows ones manually? The best test would be to install Ansible there and run with the same inventory minus the proxy variable. ---
**Author:** ![Gil\_Shinar](https://avatars.discourse-cdn.com/v4/letter/g/8e8cbc/32.png) [@Gil\_Shinar](https://forum.ansible.com/u/Gil_Shinar)\ **Post date:** [September 13, 2018, 11:03am UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/10 "2018-09-13T11:03:30Z")
I see. Good idea. The two machines (Linux and Windows) have a public IP address meaning they should be open to each other. I was able to make winrm and psrp work from my laptop directly to the Windows machine. Anyhow, I’ll try what you have suggested to be on the safe side. Thanks Gil ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [September 13, 2018, 7:40pm UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/11 "2018-09-13T19:40:59Z")
Should and could are always 2 different things 🙂 Considering you can see your bastion host attempts to connect but fails with a connection timeout then it seems like it can”t. ---
**Author:** ![Gil\_Shinar](https://avatars.discourse-cdn.com/v4/letter/g/8e8cbc/32.png) [@Gil\_Shinar](https://forum.ansible.com/u/Gil_Shinar)\ **Post date:** [September 13, 2018, 7:46pm UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/12 "2018-09-13T19:46:19Z")
I’ve moved this task to a college of mine. I’ll make sure to get back with the results of this experiment but unfortunately we are at holidays now and it might take a week or so. Sorry for that and thanks lot! ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [October 14, 2018, 10:17pm UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/13 "2018-10-14T22:17:14Z")
Hey Gil (and anyone else interested) I finally was able to document this a bit more thoroughly with a step by step example at [http://www.bloggingforlogging.com/2018/10/14/windows-host-through-ssh-bastion-on-ansible/](http://www.bloggingforlogging.com/2018/10/14/windows-host-through-ssh-bastion-on-ansible/). No idea if you are still working on this but potentially you need to define the proxy with the schema “socks5h://”, the extra h on the end means all DNS resolution is done on the bastion host and not the Ansible client. Thanks Jordan ---
**Author:** ![Gil\_Shinar](https://avatars.discourse-cdn.com/v4/letter/g/8e8cbc/32.png) [@Gil\_Shinar](https://forum.ansible.com/u/Gil_Shinar)\ **Post date:** [May 15, 2019, 9:02am UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/14 "2019-05-15T09:02:23Z")
Hi Jordan, Got back to that now. Joined forces with other team members but it just doesn’t work. We always get the error message: ConnectionError: SOCKSHTTPConnectionPool(host=‘_._._._’, port=5985): Max retries exceeded with url: /wsman (Caused by NewConnectionError(‘\: Failed to establish a new connection: [Errno 111] Connection ref used’,)) We’ve tried lots of stuff. Both ports (5985 and 5986). We’ve set the following parameters in the playbook: ansible\_user: Administrator ansible\_password: \*\*\*\*\*\*\*\* ansible\_psrp\_proxy: socks5h://0.0.0.0:1234 ansible\_connection: psrp ansible\_psrp\_protocol: http ansible\_port: 5985 We’ve also tried: ansible\_psrp\_max\_envelope\_size: 1536000 We’ve also tried socks5 instead of socks5h As for ssh configurations, we’ve used the following: Host 10.0._._ ProxyCommand ssh -CfN -D 0.0.0.0:1234 -p 22 -W %h:%p ubuntu@bastion IdentityFile ~/.ssh/keyFile.pem StrictHostKeyChecking no UserKnownHostsFile /dev/null Host bastion Hostname User ubuntu IdentityFile ~/.ssh/keyFile.pem ControlMaster auto ControlPath ~/.ssh/ansible-%r@%h:%p ControlPersist 5 StrictHostKeyChecking no UserKnownHostsFile /dev/null What else are we missing here? Everything works from inside a docker container. The bastion is an AWS instance and the remote machine is also an AWS instance. We thought that it might be a firewall on the way so we’ve created a another AWS instance and run everything from there. Nothing! Do you have any other suggestions? Thanks Gil ---
**Author:** ![Gil\_Shinar](https://avatars.discourse-cdn.com/v4/letter/g/8e8cbc/32.png) [@Gil\_Shinar](https://forum.ansible.com/u/Gil_Shinar)\ **Post date:** [May 19, 2019, 9:39am UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/15 "2019-05-19T09:39:02Z")
> > Hi Jordan, If you’ll ever see this thread again, I just want to emphasize a very important point that I think should be added to your blog. When running ansible on a non-ssh machine, ssh configurations are not being read during the connection phase. Meaning, the only way to use the socks proxy is by running the command you’ve written in your blog before running the ansible-playbook command. One cannot add that socks tunnel to an ssh configuration file or a ssh\_args under the ssh\_connection section in the ansible.cfg file. Thanks a lot for the great blog! Gil ---
**Author:** ![Jeff4](https://avatars.discourse-cdn.com/v4/letter/j/47e85d/32.png) [@Jeff4](https://forum.ansible.com/u/Jeff4)\ **Post date:** [October 1, 2019, 10:06pm UTC](https://forum.ansible.com/t/help-with-psrp-in-ansible-2-7/28561/16 "2019-10-01T22:06:40Z")
I’m running ansible 2.8.5 and the steps listed at [https://www.bloggingforlogging.com/2018/10/14/windows-host-through-ssh-bastion-on-ansible/](https://www.bloggingforlogging.com/2018/10/14/windows-host-through-ssh-bastion-on-ansible/) work within a single playbook.