从服务器代码500返回的不可接受的Windows身份验证不良HTTP响应

Question

在windows服务器上配置winRM并填充连接所需的所有信息之后：

---
### winrm / win connection ###
ansible_winrm_realm: *My AD Domain*
ansible_connection: winrm
ansible_winrm_kerberos_delegation: yes
ansible_port: 5985
ansible_winrm_transport: kerberos

我得到了一个

fatal: [MyServer]: UNREACHABLE! => {"changed": false, "msg": "kerberos: ('http', 'Bad HTTP response returned from server. Code 500')", "unreachable": true}

我尝试了很多事情，包括更改配置和检查是否可以访问WinRm，这一切都很好：

C:\Users\ME>winrs -r :http://myserver:5985/wsman -u:My_User -p:Password ipconfig

我的WinRM Config：

PS C:\Users\XXXX> winrm get winrm/config/Service
Service
    MaxConcurrentOperations = 4294967295
    MaxConcurrentOperationsPerUser = 1500
    EnumerationTimeoutms = 240000
    MaxConnections = 300
    MaxPacketRetrievalTimeSeconds = 120
    AllowUnencrypted = false
    Auth
        Basic = false
        Kerberos = true
        Negotiate = true
        Certificate = false
        CredSSP = false
        CbtHardeningLevel = Relaxed
    DefaultPorts
        HTTP = 5985
        HTTPS = 5986
    IPv4Filter = *
    IPv6Filter = *
    EnableCompatibilityHttpListener = false
    EnableCompatibilityHttpsListener = false
    CertificateThumbprint
    AllowRemoteAccess = true


PS C:\Users\XXXX> winrm get winrm/config/Winrs
Winrs
    AllowRemoteShellAccess = true
    IdleTimeout = 7200000
    MaxConcurrentUsers = 2147483647
    MaxShellRunTime = 2147483647
    MaxProcessesPerShell = 2147483647
    MaxMemoryPerShellMB = 2147483647
    MaxShellsPerUser = 2147483647

Answer 1

由于我试图使用HTTP而不是HTTPS，因此解决方案是通过运行以下命令来更改WinRm服务配置以允许加密连接：

Set-Item -Path WSMan:\localhost\Service\AllowUnencrypted -Value true

Answer 2

我遇到了这个异常，解决方案是安装包装器。

pip3 install pywinrm[kerberos]

Answer 3

最后通过将pykerberos升级到1.2.1版本来解决问题

pip3 install pykerberos --upgrade

作为解决办法，您可以使用python2运行此剧本：

/usr/bin/python2 /usr/bin/ansible-playbook WindowsTest.yml