在Ansible上转发Kerberos身份validation

我有一个可控的控制机器（host-A），需要与host-C（一个没有本地用户的Windows机器（这是一个Active Directory））交谈。

主机-A对主机C没有networking访问权限，但可以使用主机-B进行通信。

主机-B它是一个Linux机器。

host-A通过ssh访问主机B.

本文后面我创build了一个nginx服务器来在主机B上路由WinRMstream量

server { listen 5986 default ssl; server_name localhost; ssl_certificate ssl/nginx.crt; ssl_certificate_key ssl/nginx.key; location /host-c { proxy_pass https://host-c-address:5986/wsman; } }

我的主机C的库存清单就像：

 [windows] host-c ansible_host=host-b ansible_winrm_path=host-c

而windows的group_vars是：

 ansible_user: myuser ansible_pass: andmypass ansible_port: 5986 ansible_connection: winrm ansible_winrm_realm: HOSTCDOMAIN.LOCAL ansible_winrm_scheme: https ansible_winrm_transport: kerberos ansible_winrm_server_cert_validation: ignore

我迄今testing的东西

1testing没有Kerberos

改变了这一行： ansible_winrm_transport: ssl

这是不可能的，因为host-c不能拥有本地用户。

 fatal: [host-c]: FAILED! => {"failed": true, "msg": "ssl: 401 Unauthorized."}

2创build一个NAT将kerberos 88端口路由到主机C.

有了这个我可以validation我的用户使用Kerberos客户端，但不是内部的

krb5.conf的：

 [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = HOSTCDOMAIN.LOCAL dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = false [realms] HOSTCDOMAIN.LOCAL = { kdc = host-b } [domain_realm] .hostcdomain.local = HOSTCDOMAIN.LOCAL

使用本地kerberos

 # kinit [email protected] Password for [email protected]: # klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 03/12/2016 20:23:35 03/13/2016 06:23:35 krbtgt/[email protected] renew until 03/19/2016 20:23:31

Ansibletestingansible_winrm_transport: kerberos

 e# ansible-playbook test_win.yml -vvv Using /etc/ansible/ansible.cfg as config file 1 plays in test_win.yml PLAY [Ping windows] ************************************************************ TASK [ping] ******************************************************************** task path: /etc/ansible/test_win.yml:5 <host-b> ESTABLISH WINRM CONNECTION FOR USER: myuser on PORT 5986 TO host-b fatal: [host-c]: FAILED! => {"failed": true, "msg": "kerberos: (('Unspecified GSS failure. Minor code may provide more information', 851968), ('Server not found in Kerberos database', -1765328377))"}

有人能帮我弄清楚如何克服这个问题吗？我想我错过了一些东西。

host-a可以使用host-b在host-c上进行身份validation吗？