Hi
I am running ansible 2.3.1.0 on centos7. The host(windows) machine is windows 8 with powershell.
I have installed pywinrm[credssp] (Authentication method credSSP is being used) on centos and included windows hostnames in the inventory file.
Also enable credSSP authorization in winrm on the host:
winrm get winrm/config (to see the settings)
winrm set winrm/config/client/auth @{CredSSP=“True”}
or Set-Item -Path WSMan:\localhost\Service\Auth\CredSSP -Value $true
I would also check to make sure nothing else is using the default SSH listener (port 5986) I don’t think you want to use unsecure 5985, so you should set the ansible vars to 5986 and https. If that still doesn’t work maybe try adding ansible_winrm_transport: CredSSP after ansible_connection=winrm.
Seems like it is using https 5986 and you have specified 5985 , maybe
because there is a ':' in your variable ansible_port:=5985, is this a
typo ? and make sure the variables are applied to the task/play
This seems like it could be an SSL wedging issue I’ve seen from time to time. It is a weird issue where the combination of the OpenSSL version (usually older ones) that Python is compiled to use and the cipher suite selection on the remote server causes the SSL connection to lock up. Depending on the age of the server that Ansible runs on OpenSSL is probably going to be the issue, I’ve found MacOS is notorious for this as they use a pretty ancient version by default. There is a tool called IIS Crypto that can change the SChannel settings on the Windows box, I recommend using it and setting the Best Practices for the Schannel window and Cipher Suites… The tool can be found here https://www.nartac.com/Products/IISCrypto but I’m not sure if it works for the desktop Window’s OSs.
One thing you can do to rule out the SSL wedging issue is to run Ansible over HTTP (just for testing). To do this go onto your Windows box and run
winrm set winrm/config/service @{AllowUnencrypted=“true”}
Now in your host vars, set
ansible_port=5985
Run your playbook and you should see that your playbook will be running over http://X.X.X.X:5985/wsman and hopefully it works.
After your test make sure you re-enable the WinRM encryption check with
winrm set winrm/config/service @{AllowUnencrypted=“false”}
If this fixed the issue for you, bad news your SSL settings is causing some incomptabilities but you have 3 options available to continue forward
Use HTTP with message encryption disabled (highly recommended to NOT do this)
Use this (https://github.com/diyan/pywinrm/pull/156) pre-release build of pywinrm which enables message encryption with NTLM and CredSSP so you can run over HTTP and still have message encryption (this should be released soon but it technically hasn’t been released yet)
Download the latest version of OpenSSL and compile your Python install to use this instead of the system default. Also play around with the cipher suite selection on Windows box using the ISSCrypto tool
If it didn’t fix it, not sure what the issue would be but knowing as much about your environment such as how the computer was installed and other settings might help us narrow it down.
Some previous issues where this has been seen before
Do you need CredSSP? I would try NTLM if not. Maybe run NETSTAT see if it shows 5986 open and listening if you haven’t already. You can also run winrm enumerate winrm/config/listener on the host to see if a hostname is assigned. When did you install pywinrm. If it’s been a while might want to install newest version.