windows - 如何解决这个 ansible kerberos 错误？

Question

我在 WSL 和 Ansible 中安装了 Ubuntu 20.04。我试图在我的本地机器上简单地运行 Windows 更新。我已经尝试使用我的帐户、服务帐户等。我已经运行了 kinit -C myuser@DOMAIN.LOCAL 命令并拥有有效的票证。我的计算机已加入本地域为“domain.local”的 AD/Azure 混合，但我们使用 myuser@domain.com 登录计算机。
我的/etc/resolv.conf 中列出了内部域 Controller ，因此我可以 ping/访问域计算机。
我试过 ansible_user=myuser@DOMAIN.LOCAL, DOMAIN.COM, myuser, myuser@DOMAIN.COM
运行“ansible-playbook -i hosts -vvvv win-update.yml”时，我不断收到错误消息:

TASK [Gathering Facts] ******************************************************************************************************************************************************************************************
task path: /home/gmeyer/ansible/win-update.yml:5
Using module file /usr/lib/python3/dist-packages/ansible/modules/windows/setup.ps1
Pipelining is enabled.
<10.20.30.174> ESTABLISH WINRM CONNECTION FOR USER: myuser on PORT 5986 TO 10.20.30.174
fatal: [10.20.30.174]: UNREACHABLE! => {
"changed": false,
"msg": "kerberos: authGSSClientStep() failed: (('Unspecified GSS failure.  Minor code may provide more information', 851968), ('Server not found in Kerberos database', -1765328377))",
"unreachable": true
}


PLAY RECAP ******************************************************************************************************************************************************************************************************`
10.20.30.174               : ok=0    changed=0    unreachable=1    failed=0    skipped=0    rescued=0    ignored=0

My /etc/krb5.conf:
[libdefaults]
default_realm = DOMAIN.LOCAL
[realms]
X-ISS.LOCAL = {
kdc = dc.domain.local
admin_server = dc.domain.local
default_domain = domain.local
}
[domain_realm]
.domain.local = DOMAIN.LOCAL
domain.local = DOMAIN.LOCAL

我的主人:

[win]
10.20.30.174

[win:vars]
ansible_user=myuser@DOMAIN.LOCAL
ansible_connection = winrm
ansible_winrm_server_cert_validation = ignore
ansible_password = [redacted]
ansible_winrm_transport = kerberos
ansible_winrm_kerberos_delegation = true

我的剧本:

---
# DESCRIPTION
# Apply windows updates

- name: Apply windows updates
  hosts: win
  gather_facts: yes
  vars:
    initial_reboot: |-
      {{ 86400 <
          (( ((ansible_date_time.date+" "+ansible_date_time.time)|to_datetime('%Y-%m-%d %H:%M:%S')) -
              ansible_facts.lastboot|to_datetime('%Y-%m-%d %H:%M:%SZ')).total_seconds())|abs }}

  tasks:

  # Reboot systems with if up longer then day
  # this way we know that the system was able to come back
  # up before updates were applied
  - name: Reboot if system has a large uptime
    win_reboot:
    when: initial_reboot and not ansible_check_mode
    tags:
    - never
    - reboot

  - block:
    - name: >
        {{ 'Install' if 'install' in ansible_run_tags else 'Search' }} updates
        {{ 'will automatically reboot' if 'reboot' in ansible_run_tags else 'no reboot' }}
      win_updates:
        category_names:
          - SecurityUpdates
          - CriticalUpdates
          - UpdateRollups
          - DefinitionUpdates
          - Updates
        reboot: "{{ 'yes' if 'reboot' in ansible_run_tags else 'no' }}"
        state: "{{ 'installed' if 'install' in ansible_run_tags else 'searched' }}"
      become: yes
      become_method: runas
      become_user: SYSTEM
      register: update_results
      tags:
      - never
      - install
      - check

    rescue:
    - name: Windows update failed?
      debug:
        msg: "error: {{ update_results.msg }}"
      when: update_results is failed and update_results.msg is defined
      tags:
      - always
    - name: Server had pending reboots?
      win_reboot:
      when:  not ansible_check_mode and
            update_results is failed and
            update_results.msg is search('A reboot is required')
      tags:
      - never
      - reboot

    always:
    - name: Report results
      debug:
        var: update_results
      tags:
      - never
      - install
      - check

在 Ubuntu 中运行 Ansible 时，我尝试了许多不同的选项来格式化域名。我期望让脚本连接到 Windows 机器以运行 Windows 更新，但不断收到 Kerberos 错误。

Answer 1

我弄清楚了问题所在。它在我的主机文件中 - 我将这些行更改为 fqdn 并放入“ansible_host=IP ansible_connection=local”，它就起作用了!