AdminSysGNULinux

Voir :

• Connexion AD Active Directory LDAP
• Prerequisites_for_ad_to_support_sssd_id_mapping Flux réseau AD WinRM
• https://docs.semaphoreui.com/user-guide/inventory/kerberos/

Les ports suivants sont utilisés :

• 5985/tcp (En clair)
• 5986/tcp (TLS)

Verif ports en écoute

netstat -tn |findstr "5985 5986"

netsh http show iplisten
 
Get-Service WinRM

Pb Connection refused This problem occurs because one or more of the following conditions are true:

• The application is experiencing problems or is not running ?
• The user does not have Remote PowerShell Enabled status.
• Windows Remote Management (WinRM) is configured incorrectly on the server.

source : https://gist.github.com/g3rhard/b8a829b4932be9c3e8854656945f32d9

check_winrm.sh

#!/bin/bash
if [ $# -eq 0 ]; then
    echo "please provide hostname or ip address"
    exit 1
fi
 
url=$1
output=$(curl -s -f -k -m 10 --header "Content-Type: application/soap+xml;charset=UTF-8" --header "WSMANIDENTIFY: unauthenticated" http://${url}:5985/wsman --data "<s:Envelope xmlns:s=http://www.w3.org/2003/05/soap-envelope xmlns:wsmid=http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd><s:Header/><s:Body><wsmid:Identify/></s:Body></s:Envelope>" || true);
if [[ $output == *"IdentifyResponse"* ]]
then
        echo "Online";
else
        echo "Offline";
fi

winrm_check_domains.sh

#! /bin/bash
 
set -uo pipefail
 
echo "DOMAIN;IS_AD;FLUX_TCP88"
 
#for DOMAIN in $(grep -v -e '^#' domains.txt)
while read -r DOMAIN
do
        if [[ $(dig +short SRV _kerberos._tcp.dc._msdcs."${DOMAIN}" | wc -l) -eq 0 ]]
        then
                IS_DOM_AD=N
                TCP=na
        else
                IS_DOM_AD=Y
                declare -i DOM_TCP_ERR=0
                for SRV in $(getent hosts "$DOMAIN" | awk '{ print $1 }')
                do
                        echo $SRV >> plop.txt
                        timeout 2 curl -s --connect-timeout 1 telnet://"${SRV}":88 </dev/null
                        if [[ "$?" -ne 124 ]]
                        then
                                DOM_TCP_ERR=$(( DOM_TCP_ERR + 1))
                        fi
                done
                if [[ "$DOM_TCP_ERR" -eq 0 ]]
                then
                        TCP=OK
                else
                        TCP=NOK
                fi
        fi
        echo "$DOMAIN;$IS_DOM_AD;${TCP}"
# done
done < domains.txt

sudo apt-get install winrm
winrm-go -hostname 192.168.237.29 -username Administrator -password "P@ssw0rd" cmd
 
sudo apt-get install txwinrm
winrm --remote 192.168.237.29 --username "Administrator" --password "P@ssw0rd" -f "select * from Win32_NetworkAdapter"
winrm --remote 192.168.237.29 --username "Administrator" --password "P@ssw0rd"

sudo apt-get install python-pip
sudo pip install pywinrm

ansible -u Administrator -i 192.168.237.29, -m win_ping --connection=winrm -e ansible_winrm_server_cert_validation=ignore -k all
ansible -u Administrator -i 192.168.237.29, -m setup --connection=winrm -e ansible_winrm_server_cert_validation=ignore -k all

La collection ansible.windows est nécessaire.

play-test-ping-win.yml

#! /usr/bin/env ansible-playbook
---

- name: ping win
  hosts: all
  #gather_facts: no

  vars:
    #ansible_ssh_user: 'Administrator'
    ansible_winrm_user: 'Administrator'
    #ansible_ssh_pass: 'P@ssw0rd'
    #ansible_winrm_transport: basic
    #ansible_ssh_port: 5985
    ansible_winrm_port: 5985
    ansible_connection: winrm
    ansible_winrm_server_cert_validation: ignore

  tasks:
    - name: ping
      win_ping:

./play-test-ping-win.yml -i 192.168.237.29, -k

• dans les credentials utilisés : on met le realm kerberos en majuscules (Exemple : USER1@DOMAIN.LOCAL)
• dans l'inventaire, on modifie la cible en lui attribuant les caractéristiques suivantes :
  • comme nom d'hôte, utilisation du FQDN : l'hôte srv1 devient srv1.acme.local

# dig any +short _kerberos._tcp.dc._msdcs.acme.local
dig srv +short _kerberos._tcp.dc._msdcs.acme.local

nslookup
set type=all
_kerberos._tcp.acme.local
_kerberos._tcp.dc._msdcs.acme.local

Dans les variables de l'hôte

ansible_connection: winrm
ansible_winrm_host: srv1.acme.local
ansible_winrm_server_cert_validation: ignore
#ansible_winrm_port: 5986
#ansible_winrm_transport: kerberos 

Pour valider la connexion Kerberos, depuis un nœud d'exécution :

kinit USER1@ACME.LOCAL

Un mot de passe est demandé

Puis pour afficher le ticket associé.

klist

$ winrm-go -hostname 192.168.237.29 -username Administrator -password "P@ssw0rd" cmd
http error: 401 -

Erreur nom compte ou MDP

Kerberos auth failure for principal SRV_APP_PLOP@ACME.LOCAL with pexpect: Client's credentials have been revoked while getting initial credentials

Le compte est verrouillé

Voir : Windows - Active Directory - Vérifier si un compte AD est verrouillé

Erreur Ansible win_ping WinRM

{
  "unreachable": true,
  "msg": "kerberos: authGSSClientStep() failed: (('Unspecified GSS failure.  Minor code may provide more information', 851968), (\"Cannot contact any KDC for realm 'ACME.LOCAL'\", -1765328228)), ssl: the specified credentials were rejected by the server",
  "changed": false
}

$ dig A +short acme.local
192.168.18.172
172.16.1.248
172.16.1.246
172.16.1.249
172.16.1.247

Un seul serveur répond au ping (pb de routage)

$ dig A +short acme.local |xargs -P5 -I '{}' bash -c 'ping -c 1 -W 2 {} >/dev/null 2>&1 && echo {}'
192.168.18.172

Les KDC sont injoignables, sauf un.
Heureusement nous avons un KDC joignable par une autre route ou sur un autre VLAN.

$ echo "192.168.18.172 acme.local acme.local." | sudo tee -a /etc/hosts

$ dig SRV _ldap._tcp.dc._msdcs.acme.local +short |awk '{print $4}' |xargs -L1 -I'{}' bash -c 'echo 192.168.18.172 {}' | sudo tee -a /etc/hosts
192.168.18.172 dc1.acme.local.
192.168.18.172 dc2.acme.local.
192.168.18.172 dc3.acme.local.
192.168.18.172 dc4.acme.local.

Ansible requires PowerShell v3.0 or newer