{"id":728,"date":"2018-06-05T13:35:09","date_gmt":"2018-06-05T13:35:09","guid":{"rendered":"https:\/\/www.nicktailor.com\/?p=728"},"modified":"2018-06-05T15:53:59","modified_gmt":"2018-06-05T15:53:59","slug":"how-to-setup-ansible-to-manage-windows-hosts-with-centos-7","status":"publish","type":"post","link":"https:\/\/nicktailor.com\/tech-blog\/how-to-setup-ansible-to-manage-windows-hosts-with-centos-7\/","title":{"rendered":"How to setup Ansible to manage Windows hosts with Centos 7"},"content":{"rendered":"

Note- This assumes you already have a out of the box ansible setup and a windows AD and windows test VM joined to the domain.<\/strong><\/em><\/p>\n

Install Prerequisite Packages on centos7 with ansible already installed<\/strong><\/p>\n

Use Yum to install the following packages.<\/p>\n

Install GCC required for Kerberos<\/p>\n

yum -y group install \u201cDevelopment Tools\u201d<\/strong><\/p>\n

Install EPEL<\/p>\n

yum -y install epel-release<\/strong><\/p>\n

Install Ansible<\/p>\n

yum -y install ansible<\/strong><\/p>\n

Install Kerberos<\/p>\n

yum -y install python-devel krb5-devel krb5-libs krb5-workstation<\/strong><\/p>\n

Install Python PIP<\/p>\n

yum -y install python-pip<\/strong><\/p>\n

Install BIND utilities for nslookup<\/p>\n

yum -y install bind-utils<\/strong><\/p>\n

Bring all packages up to the latest version<\/p>\n

yum -y update<\/strong><\/p>\n


\nCheck that Ansible and Python is Installed<\/strong><\/p>\n

Run the commands:<\/p>\n

ansible – – version | head -l 1<\/strong><\/p>\n

python – – version<\/strong><\/p>\n

The versions of Ansible and Python here are 2.4.2 and 2.7.5. Ansible is developing extremely rapidly so these instructions will likely change in the near future.<\/p>\n

Configure Kerberos<\/strong><\/p>\n

There are other options than Kerberos, but Kerberos is generally the best option, though not the simplest.<\/p>\n

Install the Kerberos wrapper:
\npip install pywinrm[Kerberos]<\/strong><\/p>\n

Kerberos packages were installed previously which will have created \/etc\/krb5.conf<\/p>\n

Edit \/etc\/krb5.conf<\/strong><\/em><\/p>\n

[logging]
\ndefault = FILE:\/var\/log\/krb5libs.log
\nkdc = FILE:\/var\/log\/krb5kdc.log
\nadmin_server = FILE:\/var\/log\/kadmind.log
\n[libdefaults]
\ndefault_realm = HOME.NICKTAILOR.COM
\ndns_lookup_realm = false
\ndns_lookup_kdc = false
\nticket_lifetime = 24h
\nrenew_lifetime = 7d
\nforwardable = true
\n[realms]
\nHOME.NICKTAILOR.COM = {
\nkdc = HOME.NICKTAILOR.COM
\nadmin_server = HOME.NICKTAILOR.COM
\n}
\n[domain_realm]
\n.home.nicktailor.com = HOME.NICKTAILOR.COM
\nhome.nicktailor.com = HOME.NICKTAILOR.COM<\/p>\n

Test Kerberos<\/strong><\/p>\n

Run the following commands to test Kerberos:<\/p>\n

kinit administrator@HOME.NICKTAILOR.COM<\/em> <–make sure you do this exact case sensitive or your authenication will fail. Also the user has to have domain admin privileges.\u00a0<\/strong><\/p>\n

You will be prompted for the administrator password\u00a0klist<\/strong>
\nYou should see a Kerberos KEYRING record.<\/p>\n

[root@localhost win_playbooks]# klist<\/em>
\nTicket cache: FILE:\/tmp\/krb5cc_0Default principal: administrator@HOME.NICKTAILOR.COM<\/em>
\nValid starting\u00a0 \u00a0 \u00a0 \u00a0Expires\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Service principal05\/23\/2018 14:20:50\u00a0 05\/24\/2018 00:20:50\u00a0 krbtgt\/HOME.NICKTAILOR.COM@HOME.NICKTAILOR.COM renew until 05\/30\/2018 14:20:40<\/em><\/p>\n

Configure Ansible<\/strong><\/p>\n

Ansible is complex and is sensitive to the environment. Troubleshooting an environment which has never initially worked is complex and confusing. We are going to configure Ansible with the least complex possible configuration. Once you have a working environment, you can make extensions and enhancements in small steps.<\/p>\n

The core configuration of Ansible resides at \/etc\/ansible<\/p>\n

We are only going to update two files for this exercise.<\/p>\n

Update the Ansible Inventory file<\/strong><\/p>\n

Edit \/etc\/ansible\/hosts and add:<\/p>\n

[windows]<\/strong><\/p>\n

HOME.NICKTAILOR.COM<\/p>\n

\u201c[windows]\u201d is a created group of servers called \u201cwindows\u201d. In reality this should be named something more appropriate for a group which would have similar configurations, such as \u201cActive Directory Servers\u201d, or \u201cProduction Floor Windows 10 PCs\u201d, etc.<\/p>\n


\nUpdate the Ansible Group Variables for Windows<\/strong><\/p>\n

Ansible Group Variables are variable settings for a specific inventory group. In this case, we will create the group variables for the \u201cwindows\u201d servers created in the \/etc\/ansible\/hosts file.<\/p>\n

Create \/etc\/ansible\/group_vars\/windows<\/strong><\/em> and add:<\/p>\n

—<\/strong><\/p>\n

ansible_user: Administrator<\/strong><\/p>\n

ansible_password: Abcd1234<\/strong><\/p>\n

ansible_port: 5986<\/strong><\/p>\n

ansible_connection: winrm<\/strong><\/p>\n

ansible_winrm_server_cert_validation: ignore<\/strong><\/p>\n

This is a YAML configuration file, so make sure the first line is three dashes \u201c\u2010\u2010\u2010\u201d<\/strong><\/p>\n

Naturally change the Administrator password to the password for\u00a0WinServer1<\/strong>.<\/p>\n

For best practices, Ansible can encrypt this file into the Ansible Vault. This would prevent the password from being stored here in clear text. For this lab, we are attempting to keep the configuration as simple as possible. Naturally in production this would not be appropriate.<\/p>\n


\nConfigure Windows Servers to Manage<\/strong><\/p>\n

To configure the Windows Server for remote management by Ansible requires a bit of work. Luckily the Ansible team has created a PowerShell script for this. Download this script from [here] to each Windows Server to manage and run this script as Administrator.<\/p>\n

Log into\u00a0WinServer1<\/strong>\u00a0as Administrator, download\u00a0ConfigureRemotingForAnsible.ps1\u00a0<\/a>and run this PowerShell script without any parameters.<\/p>\n

Once this command has been run on the\u00a0WinServer1<\/strong>, return to the Ansible1 Controller host.<\/p>\n


\nTest Connectivity to the Windows Server<\/strong><\/p>\n

If all has gone well, we should be able to perform an Ansible PING test command. This command will simply connect to the remote\u00a0WinServer1<\/strong>\u00a0server and report success or failure.<\/p>\n

Type:
\nansible windows -m win_ping<\/strong><\/p>\n

This command runs the Ansible module \u201cwin_ping\u201d on every server in the \u201cwindows\u201d inventory group.<\/p>\n

Type:\u00a0ansible windows -m setup<\/strong>\u00a0to retrieve a complete configuration of Ansible environmental settings.<\/p>\n

Type:\u00a0ansible windows -c ipconfig<\/strong><\/p>\n

If this command is successful, the next steps will be to build Ansible playbooks to manage Windows Servers.<\/p>\n


\nManaging Windows Servers with Playbooks<\/strong><\/p>\n

 <\/p>\n

Let\u2019s create some playbooks and test Ansible for real on Windows systems.<\/p>\n

Create a folder on\u00a0Ansible1<\/strong>\u00a0for the playbooks, YAML files, modules, scripts, etc. For these exercises we created a folder under \/root called win_playbooks.<\/p>\n

Ansible has some expectations on the directory structure where playbooks reside. Create the library and scripts folders for use later in this exercise.<\/p>\n

Commands:<\/p>\n

cd \/root<\/strong><\/p>\n

mkdir win_playbooks<\/strong><\/p>\n

mkdir win_playbooks\/library<\/strong><\/p>\n

mkdir win_playbooks\/scripts<\/strong><\/p>\n

Create the first playbook example \u201cnetstate.yml\u201d
\nThe contents are:<\/p>\n

– name: test cmd from win_command module<\/strong><\/p>\n

\u00a0 hosts: windows<\/strong><\/p>\n

\u00a0 tasks:<\/strong><\/p>\n

\u00a0\u00a0\u00a0 – name: run netstat and return Ethernet stats <\/strong><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0 win_command: netstat -e<\/strong><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0 register: netstat<\/strong><\/p>\n

\u00a0\u00a0\u00a0 – debug: var=netstat<\/strong><\/p>\n

This playbook does only one task, to connect to the servers in the Ansible inventory group \u201cwindows\u201d and run the command\u00a0netstat.exe -a<\/strong>\u00a0and return the results.<\/p>\n

To run this playbook, run this command on\u00a0Ansible1<\/strong>:<\/p>\n

ansible-playbook netstat_e.yml<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Note- This assumes you already have a out of the box ansible setup and a windows AD and windows test VM joined to the domain. Install Prerequisite Packages on centos7 with ansible already installed Use Yum to install the following packages. Install GCC required for Kerberos yum -y group install \u201cDevelopment Tools\u201d Install EPEL yum -y install epel-release Install AnsibleRead More …<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[51],"tags":[],"class_list":["post-728","post","type-post","status-publish","format-standard","hentry","category-ansible"],"_links":{"self":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/728","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/comments?post=728"}],"version-history":[{"count":7,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/728\/revisions"}],"predecessor-version":[{"id":735,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/posts\/728\/revisions\/735"}],"wp:attachment":[{"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/media?parent=728"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/categories?post=728"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nicktailor.com\/tech-blog\/wp-json\/wp\/v2\/tags?post=728"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}