Trouble connecting to Windows remote node via Kerberos

Archives Ansible Project
1

Control Node:

  • CentOS 7

  • Ansible 2.1

  • pywinrm version from May 19th, 2016

Remote Node:

  • Windows 7

  • Powershell 3

I’m able to connect to my Windows remote node just fine with the powershell setting winrm/config/server/AllowUnencrypted=true. But when I change it to false I get the error below. I’m trying to use Kerberos. What am I doing wrong or how should I diagnose the problem?

$ ansible windows -m win_ping -vvvvv
No config file found; using defaults
Loaded callback minimal of type stdout, v2.0
ESTABLISH WINRM CONNECTION FOR USER: ansibleAdmin on PORT 5986 TO ADS-6999
WINRM CONNECT: transport=kerberos endpoint=https://ADS-6999:5986/wsman
WINRM CONNECTION ERROR: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘No Kerberos credentials available’, -1765328243))
Traceback (most recent call last):
File “/etc/ansible/lib/ansible/plugins/connection/winrm.py”, line 134, in _winrm_connect
protocol.send_message(‘’)
File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 193, in send_message
return self.transport.send_message(message)
File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 269, in send_message
krb_ticket = KerberosTicket(self.krb_service)
File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 205, in init
kerberos.authGSSClientStep(krb_context, ‘’)
GSSError: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘No Kerberos credentials available’, -1765328243))

ADS-6999 | FAILED! => {
“failed”: true,
“msg”: “kerberos: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘No Kerberos credentials available’, -1765328243))”
}

here is my file from the group_vars direcctory

$ cat windows.yml

2

https://groups.google.com/forum/#!topic/ansible-project/vEl-mrvFkrY

I had a few similar issues, eventually switched from kerberos to ntlm. Using the newer pywinrm seems to work like a charm thus far.
I’m assuming you have configured the krb5.conf and installed the dependencies as per http://docs.ansible.com/ansible/intro_windows.html#active-directory-support .

3

Regarding the Ansible Docs page on Installing python-kerberos dependencies, it lists 6 different install procedures. As I understand I only need to run one of these based on my os, not all 6. Is that correct?

4

Well you are running Centos 7 so typically you would use yum as your package manager:

# Via Yum
yum -y install python-devel krb5-devel krb5-libs krb5-workstation

Just remember to run it using sudo.