Ansible - Setting up kerberos authentication

Here is the counterpart of the previous video about setting up winrm. In this video we setup kerberos authentication to allow ansible to manage windows hosts which are joined to a specific domain with the help of a domain account. The setup is a bit tricky but once you get the feeling it comes natural.
Patreon: / r3ap3rpy

[@Arun-vq8bs]

Thanks for the video. I have a doubt. What is the domain controller actually ? Is the windows server we try to connect to?? Any documents or videos on it will be helpful.

[@frankguan1111]

Thanks much, this is what i am seeking for. It works in my lab !!

[@karthika393]

Thanks for the explanation, I tried everything just like you did, but I am getting this error msg": "kerberos: requested auth method is kerberos, but requests_kerberos is not installed" verified everything as suggested by other stackoverflow pages.

[@r3ap3rpy]

You have to install the "requests_kerberos" package.

[@karthika393]

@R3ap3rPy I did But it worked when I used another Linux host as master and followed your steps. It worked I am able to ping and run some win-packages on windows

[@ValhallenExile]

Of note for anyone trying to get Kerberos and HTTP 5985 winrm going with ansible on a debian based platform: The group variable called "ansible_winrm_message_encryption" needs to be set to "always" otherwise winrm requests will be denied with error 500 because they will be sent unencrypted. This is now apart of the ansible documentation aswell. Figured I would share as I spent nearly a day trying to figure this out lol. If after setting this variable you get an error message saying "ansible_winrm_message_encryption is set to always and isnt supported" then you are on the right track and just need to update pywinrm[kerberos] to the latest version.

[@kevinserafin1466]

Nice guide. Although I cant seem to get this working. Do we need to make changes in winrm config of target machines for kerberos as outlined in previous video for basic auth?

[@r3ap3rpy]

Well this is a more complex question. is xour machine domain joined? Did you edit your krb5.config file? Did you setup configuration in either the inventory or groupvara to make this work?

[@suryagunisetti]

Many thanks for the video, I have a doubt that cant we create a single inventory file in /etc/ansible/hosts by mentioning both Windows VMs FQDNs in a host group called Win VMs and variables such as username,pwd,connection etc in Win VMs:vars instead of creating 2 host inventories ?

[@r3ap3rpy]

Surya Gunisetti inwould have only one inventory.

[@ronp8319]

Great demo! Got it working all the way. But is there a way we can do this without adding the domain user to local admin group? Please suggest the solution or do a video.

[@r3ap3rpy]

Hi, you dont have to add the user to the admins. However certain commands will fail due to the lack of privilege.

[@ronp8319]

R3ap3rPy i tried removing the user from local admin group but creds are getting rejecting that time

[@cloudmalayaz7923]

Hi thanks for the tutor. I'm facing HTTPS Tunnel error. Can you help me with this?

[@r3ap3rpy]

Whats the exact error message?

[@cloudmalayaz7923]

@@r3ap3rpy the tunnel error already gone but new error prompt out which is Kerberos Unable to authenticate response

[@venkateshd1480]

Do we need to generate keytab using ktpass command from windows machine as a first step?? ktpass princ host/[e-mail] mapuser user -pass password out krb5-1.keytab

[@r3ap3rpy]

Nope

[@venkateshd1480]

@@r3ap3rpy Why i asked this question is my windows machine is not the domain controller and i don't have access to active directory to create a user in that .. If i use the login credentials as the ansible user/password it doesn't work. I am getting 'kinit: KDC reply did not match expectations while getting initial credentials'

[@r3ap3rpy]

Well you need to distinguish between domain and local users and ubderstand the difference.

[@venkateshd1480]

@@r3ap3rpy I have a local user added to the administration group. Can i use that as ansible_user/password for kerberos? P.S: I am able to connect to manage windows using that user via basic authentication.

[@r3ap3rpy]

As I said you need to clear things up regarding topics of ansible authentication... you cannot use local users for kerberos authentication...

[@88whitetiger]

audio too soft.

[@r3ap3rpy]

Never thought that would be a problem 😅