Ansible Windows Kerberos 身份验证从服务器返回错误的 HTTP 响应代码 500

Question

在 Windows 服务器上配置 winRM 并填写连接所需的所有信息后：

---
### winrm / win connection ###
ansible_winrm_realm: *My AD Domain*
ansible_connection: winrm
ansible_winrm_kerberos_delegation: yes
ansible_port: 5985
ansible_winrm_transport: kerberos

我得到了一个

fatal: [MyServer]: UNREACHABLE! => {"changed": false, "msg": "kerberos: ('http', 'Bad HTTP response returned from server. Code 500')", "unreachable": true}

我尝试了很多事情，包括更改我的配置并检查 WinRm 是否可访问，一切都很好：

C:\Users\ME>winrs -r :http://myserver:5985/wsman -u:My_User -p:Password ipconfig

我的 WinRM 配置：

PS C:\Users\XXXX> winrm get winrm/config/Service
Service
    MaxConcurrentOperations = 4294967295
    MaxConcurrentOperationsPerUser = 1500
    EnumerationTimeoutms = 240000
    MaxConnections = 300
    MaxPacketRetrievalTimeSeconds = 120
    AllowUnencrypted = false
    Auth
        Basic = false
        Kerberos = true
        Negotiate = true
        Certificate = false
        CredSSP = false
        CbtHardeningLevel = Relaxed
    DefaultPorts
        HTTP = 5985
        HTTPS = 5986
    IPv4Filter = *
    IPv6Filter = *
    EnableCompatibilityHttpListener = false
    EnableCompatibilityHttpsListener = false
    CertificateThumbprint
    AllowRemoteAccess = true


PS C:\Users\XXXX> winrm get winrm/config/Winrs
Winrs
    AllowRemoteShellAccess = true
    IdleTimeout = 7200000
    MaxConcurrentUsers = 2147483647
    MaxShellRunTime = 2147483647
    MaxProcessesPerShell = 2147483647
    MaxMemoryPerShellMB = 2147483647
    MaxShellsPerUser = 2147483647

Answer 1

由于我尝试使用 HTTP 而不是 HTTPS，解决方案是通过运行以下命令来更改 WinRm 服务配置以允许加密连接：

Set-Item -Path WSMan:\localhost\Service\AllowUnencrypted -Value true

Answer 2

我遇到了这个异常，我的解决方案是安装 python-kerberos 包装器。

pip3 install pywinrm[kerberos]