powershell user_data should support winrm over ssl by default #317
Labels
Platform: Windows
Triage: Confirmed
Indicates and issue has been confirmed as described.
Type: Bug
Doesn't work as expected.
Comments
|
I looked at winrm quickconfig and this may be one path, but we'll need to get that rdp certificate into the right place: |
|
copy-item didn't work 8( |
|
Looks like we may have a winner! Now to try and dynamically get that ssl cert into place in .chef/trusted_certs |
|
I also put together some info for getting windows to offer up winrm over ssl using the self-signed rdp certificate (cross post http://lists.opscode.com/sympa/arc/chef/2015-09/msg00290.html) On boot ec2 windows instances print a lot of useful stuff to the aws The instance comes up with knife winrm complaining about certs (See chef/knife-windows#284 (comment)) , and it seems no combination of knife ssl fetch/check works. I'm not sure where I would look in chef-provisioning-aws to I include some user_data, chef-provisioning recipe, and console output <powershell>
winrm quickconfig -q
winrm set winrm/config/winrs '@{MaxMemoryPerShellMB="300"}'
winrm set winrm/config '@{MaxTimeoutms="1800000"}'
netsh advfirewall firewall add rule name="WinRM 5986" protocol=TCP
dir=in localport=5986 action=allow
$SourceStoreScope = 'LocalMachine'
$SourceStorename = 'Remote Desktop'
$SourceStore = New-Object -TypeName
System.Security.Cryptography.X509Certificates.X509Store -ArgumentList
$SourceStorename, $SourceStoreScope
$SourceStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadOnly)
$cert = $SourceStore.Certificates | Where-Object -FilterScript {
$_.subject -like '*'
}
$DestStoreScope = 'LocalMachine'
$DestStoreName = 'My'
$DestStore = New-Object -TypeName
System.Security.Cryptography.X509Certificates.X509Store -ArgumentList
$DestStoreName, $DestStoreScope
$DestStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
$DestStore.Add($cert)
$SourceStore.Close()
$DestStore.Close()
winrm create winrm/config/listener?Address=*+Transport=HTTPS
`@`{Hostname=`"($certId)`"`;CertificateThumbprint=`"($cert.Thumbprint)`"`}
net stop winrm
sc config winrm start=auto
net start winrm
</powershell>with_machine_options bootstrap_options: {
winrm_transport: {
https: {
# This is what I'd prefer not to do, still doesn't connect
no_ssl_peer_verification: true
}
},
user_data: setup_winrm_ssl_user_data_from_above,
image_id: 'ami-7bc3e04b'
# aws-marketplace/CIS Microsoft Windows Server 2012 R2
# Benchmark v1.1.0-26bb465c-ce26-4da9-afb8-040b2f8c9a7f-ami-7a88f312.2
}
machine_name = 'win-2012-hardened-X'
m = machine "#{machine_name}" do
action :allocate
end
ruby_block "Security Info on #{machine_name}" do
block do
# wait for the machine to be in a ready state
mr=resources(machine: machine_name).provider_for_action(:ready)
mr.load_current_resource
machine=mr.action_ready
# grab a pointer to the chef-provisioning driver
# so we can call driver.config and driver.ec2.*
driver = node.run_state[:chef_provisioning].drivers.values.first
i=driver.ec2.instances[machine.machine_spec.reference['instance_id']]
# check for rdp certificate fingerprint
i.console_output.lines.each do |l|
Chef::Log.warn l.chomp
end
# just to look ot the machine_spec
machine.machine_spec.reference.pretty_inspect.lines.each do |l|
Chef::Log.warn l.chomp
end
# decrypt the password
pem = Cheffish.get_private_key(machine.machine_spec.reference['key_name'],
driver.config)
private_key = OpenSSL::PKey::RSA.new(pem)
encrypted_admin_password =
driver.wait_for_admin_password(machine.machine_spec)
decoded = Base64.decode64(encrypted_admin_password)
decrypted_password = private_key.private_decrypt decoded
Chef::Log.warn "knife ssl fetch https://#{i.private_ip_address}:5985";
Chef::Log.warn "rdesktop -u Administrator -p
'#{decrypted_password}' -g 1280x800 #{i.private_ip_address}"
Chef::Log.warn "knife winrm --winrm-port 5986 --winrm-transport ssl
--winrm-password '#{decrypted_password}' -m #{i.private_ip_address}
hostname"
# a nice place to rest until we get figure out how to get winrm +
ssl working
# TRY RUNNING 'knife winrm' HERE **************************************************
byebug
# as execution won't work until we configure winrm to actually
communicate to the node
machine.execute_always('dir "cert:\localmachine\Remote
Desktop"').stdout.lines.each do |l|
Chef::Log.warn l.chomp
end
end
end
# someday!
machine "#{machine_name}" do
action :converge
endfull ec2-get-console, there is an ec2config issued reboot to get a |
|
This should now be ready to resolve. |
|
Your final UserData effort references certId, but doesn't define it. You're missing a $certId = $env:COMPUTERNAME |
tas50
added
Type: Bug
tas50
added
Platform: Windows
Triage: Confirmed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Currently we open 5986 (winrm ssl) but do not enable it.
We should support verifying the SSL Certificate before connecting.
The easiest way to do that would be to retrieve the RDP ssl certificate signature in via GetConsoleOutput as it's available in the console output on lines with RDPCERTIFICATE:
It is available via the the certificate store:
But is created without the ability to export:
I couldn't find a way to export or copy via the command line, but using the gui to copy and paste via mmc, I was able to copy from
Remote Desktop/Certificates/HOSTNAMEtoPersonal(My?)/Certiifcates/HostnameMaybe someone with windows foo can provide that magic.
Once the certificate is available in
cert:\localmachine\my(it doesn't seem to work if you leave it incert:\localmachine\Remote Desktopyou can use the following powershell to createRunning that powershell results in:
That's looking pretty good.
Now let's try with
openssl clientand make sure we can actually communicate and see the original cert.knife ssl fetch/verifyseems to have an issue chef/knife-windows#284 and I'm tracking that sepately, and we'll have to find a way to integrate that into chef-provisioning since we won't be shelling out to knife etc.The text was updated successfully, but these errors were encountered: