Setting up SSL for Windows Remote Nodes

Archives Ansible Project
1

Control Node:

  • CentOS 7

  • Ansible 2.1

  • pywinrm version from May 19th, 2016

Remote Node:

  • Windows 7

  • Powershell 3
    Here is everything I’ve picked up so far to get SSL working. Please let me know if each of these are correct or not.

  1. I must have pywinrm installed on the management node

  2. The /etc/ansible/hosts file on the management node must have something like this

[windows]
computerName1
computerName2

  1. The directory /etc/ansible/group_vars must have a YAML file whos name matches the word in brackets above (windows in this case). So /etc/ansible/group_vars/windows.yml should look something like this

ansible_user: ansibleAdmin
ansible_password: p@$$w0rd
ansible_port: 5986
ansible_connection: winrm

  1. There must be a local account with admin privileges created on each remote node with the same username and password as listed above.

  2. A certificate request must be created on a remote node with the IIS manager and submitted to my IT department using exact name as shown above in the windows.yml file. The common name on the certificate request must be something like

ansibleAdmin.aa.bb.acme.com

  1. The certificate(s) sent back to me from the IT department must be imported using mmc on each remote node.

  2. Each remote node must be running powershell and have downloaded and run Trond Hindenes powershell script for enabling WinRM/PSRemoting

  3. If all of this is done correctly I should get a pong from each of my remote nodes when I type my win_ping request as shown below

$ansible windows -m win_ping

Is all of this correct? Am I missing anything?

2

Okay, it works now. I was missing just one thing. On line 139 of the powershell script I had to hard-code the common name used for my certificate. Like this…

139 $valueset.Add('Hostname", “ansibleAdmin.aa.bb.acme.com”)

where ansibleAdmin is the local account with admin privileges described in step 4 above.