Winrs工作，而pywinrm模块返回“指定的凭据被服务器拒绝”错误。

Question

我有一个设置，在那里我可以成功地赢到远程机器，没有任何问题。然而，当我使用pywinrm时，我会得到一个关于凭据的错误。

以下是机器远程窗口的身份验证详细信息。如何调试此问题？

winrm get winrm/config/service/auth
Auth
    Basic = false [Source="GPO"]
    Kerberos = true [Source="GPO"]
    Negotiate = false [Source="GPO"]
    Certificate = false
    CredSSP = false [Source="GPO"]
    CbtHardeningLevel = Strict [Source="GPO"]

我在windows和linux上都尝试过这一点，并且得到了相同的结果。在windows机器上，我可以无问题地完成winrs操作。

Windows输出：

import winrm
sess = winrm.Session('<hostname>', auth=('MOzsoy', '***'), transport='kerberos')
sess.run_cmd('hostname')
Traceback (most recent call last):
  File "C:\Users\mozsoy\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\winrm\transport.py", line 328, in _send_message_request
    response.raise_for_status()
  File "C:\Users\mozsoy\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\requests\models.py", line 1021, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 401 Client Error:  for url: http://<hostname>:5985/wsman

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "C:\Users\mozsoy\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\winrm\__init__.py", line 40, in run_cmd
    shell_id = self.protocol.open_shell()
  File "C:\Users\mozsoy\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\winrm\protocol.py", line 166, in open_shell
    res = self.send_message(xmltodict.unparse(req))
  File "C:\Users\mozsoy\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\winrm\protocol.py", line 243, in send_message
    resp = self.transport.send_message(message)
  File "C:\Users\mozsoy\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\winrm\transport.py", line 322, in send_message
    response = self._send_message_request(prepared_request, message)
  File "C:\Users\mozsoy\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.10_qbz5n2kfra8p0\LocalCache\local-packages\Python310\site-packages\winrm\transport.py", line 332, in _send_message_request
    raise InvalidCredentialsError("the specified credentials were rejected by the server")
winrm.exceptions.InvalidCredentialsError: the specified credentials were rejected by the server

Linux输出：

import winrm
sess = winrm.Session('<hostname>', auth=('MOzsoy', '***'), transport='kerberos')
sess.run_cmd("hostname")
/home/mozsoy/.local/lib/python3.7/site-packages/winrm/vendor/requests_kerberos/kerberos_.py:176: NoCertificateRetrievedWarning: Requests is running with a non urllib3 backend, cannot retrieve server certificate for CBT
  NoCertificateRetrievedWarning)
Traceback (most recent call last):
  File "/home/mozsoy/.local/lib/python3.7/site-packages/winrm/transport.py", line 328, in _send_message_request
    response.raise_for_status()
  File "/usr/lib/python3/dist-packages/requests/models.py", line 840, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 401 Client Error:  for url: http://<hostname>:5985/wsman

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/mozsoy/.local/lib/python3.7/site-packages/winrm/__init__.py", line 40, in run_cmd
    shell_id = self.protocol.open_shell()
  File "/home/mozsoy/.local/lib/python3.7/site-packages/winrm/protocol.py", line 166, in open_shell
    res = self.send_message(xmltodict.unparse(req))
  File "/home/mozsoy/.local/lib/python3.7/site-packages/winrm/protocol.py", line 243, in send_message
    resp = self.transport.send_message(message)
  File "/home/mozsoy/.local/lib/python3.7/site-packages/winrm/transport.py", line 309, in send_message
    self.build_session()
  File "/home/mozsoy/.local/lib/python3.7/site-packages/winrm/transport.py", line 292, in build_session
    self.setup_encryption()
  File "/home/mozsoy/.local/lib/python3.7/site-packages/winrm/transport.py", line 298, in setup_encryption
    self._send_message_request(prepared_request, '')
  File "/home/mozsoy/.local/lib/python3.7/site-packages/winrm/transport.py", line 332, in _send_message_request
    raise InvalidCredentialsError("the specified credentials were rejected by the server")
winrm.exceptions.InvalidCredentialsError: the specified credentials were rejected by the server

Answer 1

似乎pywinrm不喜欢这样的设置: CbtHardeningLevel = Source="GPO“

由于它是通过GPO配置的，因此您可能需要联系管理员。

据我目前所发现，pywinrm不能处理“严格”，但您需要使用“轻松”

我遇到这种情况是因为Ansible，但我想是因为pywinrm。

https://github.com/diyan/pywinrm/issues/109

https://docs.ansible.com/ansible/latest/user_guide/windows_setup.html#http-401-credentials-rejected