首页 文章

Ansible for Windows:无法通过WinRM访问Windows机器

提问于
浏览
1

我在我的Linux(14.04)工作站上安装了Ansible,以及Python(2.7.6),ansible(2.3.0),pywinrm(0.2.1) . 我想使用Ansible来配置我的Windows VM . 我在Azure中有一个Windows VM(Win2k12r2) . 我已打开Azure网络安全组中的所有端口,并且已在Windows防火墙中为WinRM(5985和5986)打开了端口 .

我还在我的Windows VM中运行了位于https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1的脚本,以确保启用WinRM .

我能够将RDP引入Windows VM,因此我知道它的公共网络接口正在运行 .

根据ansible docs(http://docs.ansible.com/ansible/intro_windows.html),我有一个库存文件inventoryories / test1

[windows]
<azure_ip_address>

我有一个文件group_vars / windows.yml

ansible_user: <my_user_id>
ansible_password: <azure_vm_password>
ansible_port: 5986
ansible_connection: winrm
# The following is necessary for Python 2.7.9+ when using default WinRM self-signed certificates:
ansible_winrm_server_cert_validation: ignore
ansible_winrm_scheme: https

当我运行命令时:

ansible windows -i inventories/test1 -m win_ping --ask-vault-pass -vvvvv

我收到以下回复:

No config file found; using defaults
Vault password:
Loading callback plugin minimal of type stdout, v2.0 from /home/jgodse/ansible/lib/ansible/plugins/callback/__init__.pyc
Using module file /home/jgodse/ansible/lib/ansible/modules/core/windows/win_ping.ps1
<azure_vm_ip_address> ESTABLISH SSH CONNECTION FOR USER: None
<azure_vm_ip_address> SSH: ansible.cfg set ssh_args: (-C)(-o)(ControlMaster=auto)(-o)(ControlPersist=60s)
<azure_vm_ip_address> SSH: ansible_password/ansible_ssh_pass not set: (-o) (KbdInteractiveAuthentication=no)(-o)(PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey)(-o)(PasswordAuthentication=no)
<azure_vm_ip_address> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)
<azure_vm_ip_address> SSH: PlayContext set ssh_common_args: ()
<azure_vm_ip_address> SSH: PlayContext set ssh_extra_args: ()
<azure_vm_ip_address> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/jgodse/.ansible/cp/ansible-ssh-%h-%p-%r)
<azure_vm_ip_address> SSH: EXEC ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/jgodse/.ansible/cp/ansible-ssh-%h-%p-%r <azure_vm_ip_address> '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1477490434.84-228998637685624 `" && echo ansible-tmp-1477490434.84-228998637685624="` echo $HOME/.ansible/tmp/ansible-tmp-1477490434.84-228998637685624 `" ) && sleep 0'"'"''
<azure_vm_ip_address> | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 19: Applying options for *\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket \"/home/jgodse/.ansible/cp/ansible-ssh-<azure_vm_ip_address>-22-jgodse\" does not exist\r\ndebug2: ssh_connect: needpriv 0\r\ndebug1: Connecting to <azure_vm_ip_address> [<azure_vm_ip_address>] port 22.\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug1: connect to address <azure_vm_ip_address> port 22: Connection timed out\r\nssh: connect to host <azure_vm_ip_address> port 22: Connection timed out\r\n",
    "unreachable": true
}

我试着telnet到机器如下:

$ telnet <azure_vm_ip_address> 5986
Trying <azure_vm_ip_address>...
Connected to <azure_vm_ip_address>.
Escape character is '^]'.

这告诉我telnet工作到5986,因此我的防火墙规则没问题 .

我是否必须做一些事情来告诉Ansible我正在尝试使用WinRM连接到Windows VM?或者我错过了一些东西来帮助我的Ansible工作站通过WinRM连接到我的Windows VM?

1 回答

  • 1

    事实证明,将连接变量放在group_vars / windows.yml中是行不通的 . 我完全摆脱了那个文件,并编辑了inventoryories / test1,如下所示:

    [windows]
    <azure_ip_address>
    
    [windows:vars]
    ansible_user=<my_user_id>
    ansible_password=<azure_vm_password>
    ansible_port=5986
    ansible_connection=winrm
    ansible_winrm_server_cert_validation=ignore
    

    运行命令工作,运行win_ping成功运行 .

    然后我尝试加密库存/ test1,我得到了:

    [WARNING]: No hosts matched, nothing to do
    

    并且win_ping没有运行 .

    我在这一点上的猜测是,连接初始化所需的变量必须在库存文件中,并且在加密变量被解密和使用之前被读取 .

相关问题