Ansible is a popular automation tool for infrastructure configuration. It runs on the Linux system. CentOS is an ideal distribution to run Ansible for lab purposes. It is similar to the Red Hat Linux but free. And the latest major release is CentOS 8. It contains Python 3 by default. So the Ansible configuration is different from CentOS 7. I will focus on the configuration in the lab environment. The goal is to create a simple environment to manage Windows servers with Ansible.

Ansible Installation on CentOS 8

I used CentOS 8 mini installation. It has no extra software installed. The procedure below maybe a bit different from your environment if you installed other roles on the OS.

Ansible is a standalone application that not rely on databases. There are two files it mainly needed in a quick lab environment: Playbook and host files. You can install multiple Ansible servers. They can run independently to control the same group of Windows servers.

I would suggest you take a snapshot before moving forward if your Ansible will running on a virtual machine.

1. Enable Extra Packages for Enterprise Linux for yum.

yum install epel-release

2. Install Ansible

yum install ansible

3. (Optional) Install pip for Python 3. This step is for Red Hat 8.

yum install python3-pip

4. Install pywinrm. The pywinrm will be used to communicate to Windows servers via winrm.

pip3 install pywinrm

5. Install dependencies for pywinrm to use Kerberos in order to authenticate to Active Directory.

yum install gcc python3-devel krb5-devel krb5-libs krb5-workstation
pip3 install pywinrm[kerberos]

Ansible installation is completed. The procedure is elementary level but I spent some time figuring it out. Especially the Kerberos and pywinrm parts. 🙂

Please go to pywinrm GitHub if you want to dig into it.

Ansible Configuration on CentOS 8

Configure Ansible

As I mentioned in the previous section. There are two main files: Playbook and host. A Playbook is a file consist of multiple tasks that will run on the target Windows servers. It’s not covered by this article. The host file stores variables, and target server FQDNs or IP addresses. Ansible gets the target servers’ information in the host file when you run a playbook.

The host file location is /etc/ansible/hosts. There are two sections in the file for lab purpose.

[windows]
win2019test1.zhengwu.org

[windows:vars]
ansible_user='administrator@ZHENGWU.ORG'
ansible_password='123321'
ansible_connection='winrm'
ansible_winrm_scheme='http'
ansible_port='5985'
ansible_winrm_transport='kerberos'
ansible_winrm_server_cert_validation='ignore'

default_realm = ZHENGWU.ORG

[realms]
ZHENGWU.ORG = {
     kdc = DC.ZHENGWU.ORG
     admin_server = DC.ZHENGWU.ORG
 }

Please refer to MIT Kerberos Documentation for the explanation.

Now Kerberos is configured. We have configured domain credentials in Ansible configuration file, specified Kerberos as the authentication method, and configured Kerberos for Active Directory. We just need to run the Windows ping module in Ansible to test the connection to target Windows servers. You should complete section Manage Windows servers with Ansible if the testing is failed.

ansible windows -m win_ping

You should see following output if authentication is successfully.

win2019test1.zhengwu.org | SUCCESS => {
    "changed": false,
    "ping": "pong"
}

Kerberos troubleshooting

You may see authentication problem when validating target Windows server connection by Ansible win_ping module. Here is simple steps to troubleshooting Kerberos authentication

1. Try authenticate to target Windows servers by domain account on Ansible server. It can be any domain account.

kinit administrator@ZHENGWU.ORG

2. List cached authentication data. You should see something similar below.

Ticket cache: KCM:0
Default principal: administrator@ZHENGWU.ORG
Valid starting       Expires              Service principal
06/26/2020 03:56:12  06/26/2020 13:56:12  krbtgt/ZHENGWU.ORG@ZHENGWU.ORG
        renew until 07/03/2020 03:56:09

Manage Windows servers with Ansible

The target Windows servers should be configured to accept the winrm connection. Ansible provides a PowerShell script to configure target Windows servers automatically. The script should not be used in a production environment according to Ansible stated in their document.

The configuration is super easy for production. Open a command prompt under the administrator permission and then run following command

winrm quickconfig

Conclusion

Manage Windows servers with Ansible is not so hard as long as the authentication is configured correctly. Ansible is not the only tool for automation. I’m a super fan of PowerShell. I have posted some articles for automation you may want to check. PowerShell and Ansible both are automation tools.

I think manage Windows server with Ansible is like outsourcing PowerShell scripting works to communities. You give inputs to the tasks then Ansible modules will execute pre-defined PowerShell scripts and feedbacks output. Ansible reduces the development time of Windows automation but it still has some disadvantages. Such as you have to run multiple tasks to enable Remote Desktop on target Windows servers which is just a single task in PowerShell DSC. So I think automation of infrastructure is a combination of tools like Swiss Army Muti-Tools, each one has an advantage. We have to use them together to achieve the final goal of automation.