Ansible控制Windows操作步骤，

文章由LinuxBoy分享于2020-04-01 07:04:20热评（230）

Ansible控制Windows操作步骤，

环境：

CentOS 6.75（Ansible 2.0）

Windows Server 2012 （PowerShell 4.0）

1、确保PowerShell版本为3.0以上

ansible要控制windows，必须要求windows主机的PowerShell版本为3.0以上，如果版本不满足要求需要升级PowerShell。

查看PowerShell版本可以使用以下命令

1	`$PSVersionTable.PSVersion`

如果版本不满足要求，可以使用下面脚本进行升级（将脚本内容保存到一个powershell脚本中，）

首先启动powershell必须是用超管权限启动，然后 set-ExecutionPolicy RemoteSigned ，以后才能正确执行下面的脚本（脚本随便放哪都行，找到放置的对应路径就行）

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 [html] view plain copy print? # Powershell script to upgrade a PowerShell 2.0 system to PowerShell 3.0 # based on http://occasionalutility.blogspot.com/2013/11/everyday-powershell-part-7-powershell.html # # some Ansible modules that may use Powershell 3 features, so systems may need # to be upgraded. This may be used by a sample playbook. Refer to the windows # documentation on docs.ansible.com for details. # # - hosts: windows # tasks: # - script: upgrade_to_ps3.ps1 # Get version of OS # 6.0 is 2008 # 6.1 is 2008 R2 # 6.2 is 2012 # 6.3 is 2012 R2 if ($PSVersionTable.psversion.Major -ge 3) { write-host "Powershell 3 Installed already; You don't need this" Exit } $powershellpath = "C:\powershell" function download-file { param ([string]$path, [string]$local) $client = new-object system.net.WebClient $client.Headers.Add("user-agent", "PowerShell") $client.downloadfile($path, $local) } if (!(test-path $powershellpath)) { New-Item -ItemType directory -Path $powershellpath } # .NET Framework 4.0 is necessary. #if (($PSVersionTable.CLRVersion.Major) -lt 2) #{ # $DownloadUrl = "http://download.microsoft.com/download/B/A/4/BA4A7E71-2906-4B2D-A0E1-80CF16844F5F/dotNetFx45_Full_x86_x64.exe" # $FileName = $DownLoadUrl.Split('/')[-1] # download-file $downloadurl "$powershellpath\$filename" # ."$powershellpath\$filename" /quiet /norestart #} #You may need to reboot after the .NET install if so just run the script again. # If the Operating System is above 6.2, then you already have PowerShell Version > 3 if ([Environment]::OSVersion.Version.Major -gt 6) { write-host "OS is new; upgrade not needed." Exit } $osminor = [environment]::OSVersion.Version.Minor $architecture = $ENV:PROCESSOR_ARCHITECTURE if ($architecture -eq "AMD64") { $architecture = "x64" } else { $architecture = "x86" } if ($osminor -eq 1) { $DownloadUrl = "http://download.microsoft.com/download/E/7/6/E76850B8-DA6E-4FF5-8CCE-A24FC513FD16/Windows6.1-KB2506143-" + $architecture + ".msu" } elseif ($osminor -eq 0) { $DownloadUrl = "http://download.microsoft.com/download/E/7/6/E76850B8-DA6E-4FF5-8CCE-A24FC513FD16/Windows6.0-KB2506146-" + $architecture + ".msu" } else { # Nothing to do; In theory this point will never be reached. Exit } $FileName = $DownLoadUrl.Split('/')[-1] download-file $downloadurl "$powershellpath\$filename" write-host "$powershellpath\$filename" Start-Process -FilePath "$powershellpath\$filename" -ArgumentList /quiet

执行完了之后，需要重启电脑（自动），然后可以使用get-host查看是否成功升级！

如果升级成功，继续执行下面的配置winrm的脚本

2、执行脚本配置vinrm

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 [html] view plain copy print? # Configure a Windows host for remote management with Ansible # ----------------------------------------------------------- # # This script checks the current WinRM/PSRemoting configuration and makes the # necessary changes to allow Ansible to connect, authenticate and execute # PowerShell commands. # # Set $VerbosePreference = "Continue" before running the script in order to # see the output messages. # # Written by Trond Hindenes <trond@hindenes.com> # Updated by Chris Church <cchurch@ansible.com> # # Version 1.0 - July 6th, 2014 # Version 1.1 - November 11th, 2014 Param ( [string]$SubjectName = $env:COMPUTERNAME, [int]$CertValidityDays = 365, $CreateSelfSignedCert = $ true ) Function New-LegacySelfSignedCert { Param ( [string]$SubjectName, [int]$ValidDays = 365 ) $name = New-Object -COM "X509Enrollment.CX500DistinguishedName.1" $name.Encode("CN=$SubjectName", 0) $key = New-Object -COM "X509Enrollment.CX509PrivateKey.1" $key.ProviderName = "Microsoft RSA SChannel Cryptographic Provider" $key.KeySpec = 1 $key.Length = 1024 $key.SecurityDescriptor = "D:PAI(A;;0xd01f01ff;;;SY)(A;;0xd01f01ff;;;BA)(A;;0x80120089;;;NS)" $key.MachineContext = 1 $key.Create() $serverauthoid = New-Object -COM "X509Enrollment.CObjectId.1" $serverauthoid.InitializeFromValue("1.3.6.1.5.5.7.3.1") $ekuoids = New-Object -COM "X509Enrollment.CObjectIds.1" $ekuoids.Add($serverauthoid) $ekuext = New-Object -COM "X509Enrollment.CX509ExtensionEnhancedKeyUsage.1" $ekuext.InitializeEncode($ekuoids) $cert = New-Object -COM "X509Enrollment.CX509CertificateRequestCertificate.1" $cert.InitializeFromPrivateKey(2, $key, "") $cert.Subject = $name $cert.Issuer = $cert.Subject $cert.NotBefore = (Get-Date).AddDays(-1) $cert.NotAfter = $cert.NotBefore.AddDays($ValidDays) $cert.X509Extensions.Add($ekuext) $cert.Encode() $enrollment = New-Object -COM "X509Enrollment.CX509Enrollment.1" $enrollment.InitializeFromRequest($cert) $certdata = $enrollment.CreateRequest(0) $enrollment.InstallResponse(2, $certdata, 0, "") # Return the thumbprint of the last installed cert. Get-ChildItem "Cert:\LocalMachine\my"| Sort-Object NotBefore -Descending | Select -First 1 | Select -Expand Thumbprint } # Setup error handling. Trap { $_ Exit 1 } $ErrorActionPreference = "Stop" # Detect PowerShell version. If ($PSVersionTable.PSVersion.Major -lt 3) { Throw "PowerShell version 3 or higher is required." } # Find and start the WinRM service. Write-Verbose "Verifying WinRM service." If (!(Get-Service "WinRM")) { Throw "Unable to find the WinRM service." } ElseIf ((Get-Service "WinRM").Status -ne "Running") { Write-Verbose "Starting WinRM service." Start-Service -Name "WinRM" -ErrorAction Stop } # WinRM should be running; check that we have a PS session config. If (!(Get-PSSessionConfiguration -Verbose:$false) -or (!(Get-ChildItem WSMan:\localhost\Listener))) { Write-Verbose "Enabling PS Remoting." Enable-PSRemoting -Force -ErrorAction Stop } Else { Write-Verbose "PS Remoting is already enabled." } # Make sure there is a SSL listener. $listeners = Get-ChildItem WSMan:\localhost\Listener If (!($listeners | Where {$_.Keys -like "TRANSPORT=HTTPS"})) { # HTTPS-based endpoint does not exist. If (Get-Command "New-SelfSignedCertificate" -ErrorAction SilentlyContinue) { $cert = New-SelfSignedCertificate -DnsName $ env:COMPUTERNAME -CertStoreLocation "Cert:\LocalMachine\My" $thumbprint = $cert.Thumbprint } Else { $thumbprint = New-LegacySelfSignedCert -SubjectName $ env:COMPUTERNAME } # Create the hashtables of settings to be used. $valueset = @{} $valueset.Add('Hostname', $env:COMPUTERNAME) $valueset.Add('CertificateThumbprint', $thumbprint) $selectorset = @{} $selectorset.Add('Transport', 'HTTPS') $selectorset.Add('Address', '*') Write-Verbose "Enabling SSL listener." New-WSManInstance -ResourceURI 'winrm/config/Listener' -SelectorSet $selectorset -ValueSet $valueset } Else { Write-Verbose "SSL listener is already active." } # Check for basic authentication. $basicAuthSetting = Get-ChildItem WSMan:\localhost\Service\Auth | Where {$_.Name -eq "Basic"} If (($basicAuthSetting.Value) -eq $false) { Write-Verbose "Enabling basic auth support." Set-Item -Path "WSMan:\localhost\Service\Auth\Basic" -Value $true } Else { Write-Verbose "Basic auth is already enabled." } # Configure firewall to allow WinRM HTTPS connections. $fwtest1 = netsh advfirewall firewall show rule name="Allow WinRM HTTPS" $fwtest2 = netsh advfirewall firewall show rule name="Allow WinRM HTTPS" profile=any If ($fwtest1.count -lt 5) { Write-Verbose "Adding firewall rule to allow WinRM HTTPS." netsh advfirewall firewall add rule profile=any name="Allow WinRM HTTPS" dir=in localport=5986 protocol=TCP action=allow } ElseIf (($fwtest1.count -ge 5) -and ($fwtest2.count -lt 5)) { Write-Verbose "Updating firewall rule to allow WinRM HTTPS for any profile." netsh advfirewall firewall set rule name="Allow WinRM HTTPS" new profile=any } Else { Write-Verbose "Firewall rule already exists to allow WinRM HTTPS." } # Test a remoting connection to localhost, which should work. $httpResult = Invoke-Command -ComputerName "localhost" -ScriptBlock {$env:COMPUTERNAME} -ErrorVariable httpError -ErrorAction SilentlyContinue $httpsOptions = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck $httpsResult = New-PSSession -UseSSL -ComputerName "localhost" -SessionOption $httpsOptions -ErrorVariable httpsError -ErrorAction SilentlyContinue If ($httpResult -and $httpsResult) { Write-Verbose "HTTP and HTTPS sessions are enabled." } ElseIf ($httpsResult -and !$httpResult) { Write-Verbose "HTTP sessions are disabled, HTTPS session are enabled." } ElseIf ($httpResult -and !$httpsResult) { Write-Verbose "HTTPS sessions are disabled, HTTP session are enabled." } Else { Throw "Unable to establish an HTTP or HTTPS remoting session." } Write-Verbose "PS Remoting has been successfully configured for Ansible."

注意：上面这个脚本是我网上找的，默认应该是没有启用SSL，所以使用的是HTTP认证，而不是HTTPS认证

3、确认inrm是否开启

winrm quickconfig

4、配置winrm

执行下面两条命令配置winrm

1 2	`C:\Users\Administrator> winrm` `set` `winrm/config/service/auth` `'@{Basic="true"}'` `C:\Users\Administrator> winrm` `set` `winrm/config/service` `'@{AllowUnencrypted="true"}'`

5、ansible主机上安装pywinrm模块

1 2 3 4 5 pip install http://github.com/diyan/pywinrm/archive/master.zip#egg=pywinrm [root@SRV-OPS10-ANSIBLE04 files]# pip list | grep pywinrm You are using pip version 7.1.0, however version 8.1.2 is available. You should consider upgrading via the 'pip install --upgrade pip' command. pywinrm (0.2.0)

6、测试ansible能否控制Windows

配信hosts文件和变量

1 2 3 4 5 6 7 8 9 vim /etc/ansible/hosts [win] 172.16.206.150 vim /etc/ansible/group_vars/win.yml ansible_user: administrator ansible_password: "Pass123qwe" ansible_ssh_port: 5986 ansible_connection: winrm ansible_winrm_server_cert_validation: ignore

测试win_ping模块

1 2 3 4 5 ansible win -m win_ping SRV-SPMS10-WEB02 | SUCCESS => { "changed": false, "ping": "pong" }

排错

1 2 3 4 5 6 <172.16.206.150> ESTABLISH WINRM CONNECTION FOR USER: Administrator on PORT 5986 TO 172.16.206.150 172.16.206.150 | UNREACHABLE! => { "changed": false, "msg": "ssl: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed", "unreachable": true }

报以上错误是因为windows上没有开启SSL，所以不支持HTTPS，只能使用HTTP。

只需要修改ansible_ssh_port为5985

注意，ansible2.0以后，将ansible_ssh_prot,ansible_ssh_user,ansible_ssh_connection简写成了

ansible_port、ansible_user、ansible_connection

扩展：使用HTTPS

如果想使用HTTPS，则可以在第2步执行以下脚本

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 # Configure a Windows host for remote management with Ansible # ----------------------------------------------------------- # # This script checks the current WinRM/PSRemoting configuration and makes the # necessary changes to allow Ansible to connect, authenticate and execute # PowerShell commands. # # Set $VerbosePreference = "Continue" before running the script in order to # see the output messages. # Set $SkipNetworkProfileCheck to skip the network profile check. Without # specifying this the script will only run if the device's interfaces are in # DOMAIN or PRIVATE zones. Provide this switch if you want to enable winrm on # a device with an interface in PUBLIC zone. # # Written by Trond Hindenes <trond@hindenes.com> # Updated by Chris Church <cchurch@ansible.com> # Updated by Michael Crilly <mike@autologic.cm> # # Version 1.0 - July 6th, 2014 # Version 1.1 - November 11th, 2014 # Version 1.2 - May 15th, 2015 # Version 1.3 - May 4th, 2016 By Roger # Version 1.4 - June 2th, 2016 By Roger Param ( [string]$SubjectName = $env:COMPUTERNAME, [int]$CertValidityDays = 3650, [switch]$SkipNetworkProfileCheck, $CreateSelfSignedCert = $ true ) Function New-LegacySelfSignedCert { Param ( [string]$SubjectName, [int]$ValidDays = 3650 ) $name = New-Object -COM "X509Enrollment.CX500DistinguishedName.1" $name.Encode("CN=$SubjectName", 0) $key = New-Object -COM "X509Enrollment.CX509PrivateKey.1" $key.ProviderName = "Microsoft RSA SChannel Cryptographic Provider" $key.KeySpec = 1 $key.Length = 1024 $key.SecurityDescriptor = "D:PAI(A;;0xd01f01ff;;;SY)(A;;0xd01f01ff;;;BA)(A;;0x80120089;;;NS)" $key.MachineContext = 1 $key.Create() $serverauthoid = New-Object -COM "X509Enrollment.CObjectId.1" $serverauthoid.InitializeFromValue("1.3.6.1.5.5.7.3.1") $ekuoids = New-Object -COM "X509Enrollment.CObjectIds.1" $ekuoids.Add($serverauthoid) $ekuext = New-Object -COM "X509Enrollment.CX509ExtensionEnhancedKeyUsage.1" $ekuext.InitializeEncode($ekuoids) $cert = New-Object -COM "X509Enrollment.CX509CertificateRequestCertificate.1" $cert.InitializeFromPrivateKey(2, $key, "") $cert.Subject = $name $cert.Issuer = $cert.Subject $cert.NotBefore = (Get-Date).AddDays(-1) $cert.NotAfter = $cert.NotBefore.AddDays($ValidDays) $cert.X509Extensions.Add($ekuext) $cert.Encode() $enrollment = New-Object -COM "X509Enrollment.CX509Enrollment.1" $enrollment.InitializeFromRequest($cert) $certdata = $enrollment.CreateRequest(0) $enrollment.InstallResponse(2, $certdata, 0, "") # Return the thumbprint of the last installed certificate; # This is needed for the new HTTPS WinRM listerner we're # going to create further down. Get-ChildItem "Cert:\LocalMachine\my"| Sort-Object NotBefore -Descending | Select -First 1 | Select -Expand Thumbprint } # Setup error handling. Trap { $_ Exit 1 } $ErrorActionPreference = "Stop" Get-ChildItem cert:\LocalMachine\My | where-object {$_.Thumbprint -ne '6084E84C6B52584FB35050BFCBB02C0E639CECAC' -and $_.Thumbprint -ne "22919AFEDEFC7F6A75BB6CDC1366DC7A6A5C1953" } | ForEach-Object { $store = Get-Item $_.PSParentPath $store.Open('ReadWrite') $store.Remove($_) $store.Close() Write-Verbose "Deleted exist cert." } If (Get-ChildItem WSMan:\localhost\Listener) { winrm delete winrm/config/Listener?Address=*+Transport=HTTPS Write-Verbose "Deleted exist Listener." } # Detect PowerShell version. If ($PSVersionTable.PSVersion.Major -lt 3) { Throw "PowerShell version 3 or higher is required." } # Find and start the WinRM service. Write-Verbose "Verifying WinRM service." If (!(Get-Service "WinRM")) { Throw "Unable to find the WinRM service." } ElseIf ((Get-Service "WinRM").Status -ne "Running") { Write-Verbose "Starting WinRM service." Start-Service -Name "WinRM" -ErrorAction Stop } # WinRM should be running; check that we have a PS session config. If (!(Get-PSSessionConfiguration -Verbose:$false) -or (!(Get-ChildItem WSMan:\localhost\Listener))) { if ($SkipNetworkProfileCheck) { Write-Verbose "Enabling PS Remoting without checking Network profile." Enable-PSRemoting -SkipNetworkProfileCheck -Force -ErrorAction Stop } else { Write-Verbose "Enabling PS Remoting" Enable-PSRemoting -Force -ErrorAction Stop } } Else { Write-Verbose "PS Remoting is already enabled." } # Make sure there is a SSL listener. $listeners = Get-ChildItem WSMan:\localhost\Listener If (!($listeners | Where {$_.Keys -like "TRANSPORT=HTTPS"})) { # HTTPS-based endpoint does not exist. If (Get-Command "New-SelfSignedCertificate" -ErrorAction SilentlyContinue) { $cert = New-SelfSignedCertificate -DnsName $SubjectName -CertStoreLocation "Cert:\LocalMachine\My" $thumbprint = $cert.Thumbprint Write-Host "Self-signed SSL certificate generated; thumbprint: $thumbprint" } Else { $thumbprint = New-LegacySelfSignedCert -SubjectName $SubjectName Write-Host "(Legacy) Self-signed SSL certificate generated; thumbprint: $thumbprint" } # Create the hashtables of settings to be used. $valueset = @{} $valueset.Add('Hostname', $SubjectName) $valueset.Add('CertificateThumbprint', $thumbprint) $selectorset = @{} $selectorset.Add('Transport', 'HTTPS') $selectorset.Add('Address', '*') Write-Verbose "Enabling SSL listener." New-WSManInstance -ResourceURI 'winrm/config/Listener' -SelectorSet $selectorset -ValueSet $valueset } Else { Write-Verbose "SSL listener is already active." } # Check for basic authentication. $basicAuthSetting = Get-ChildItem WSMan:\localhost\Service\Auth | Where {$_.Name -eq "Basic"} If (($basicAuthSetting.Value) -eq $false) { Write-Verbose "Enabling basic auth support." Set-Item -Path "WSMan:\localhost\Service\Auth\Basic" -Value $true } Else { Write-Verbose "Basic auth is already enabled." } # Configure firewall to allow WinRM HTTPS connections. $fwtest1 = netsh advfirewall firewall show rule name="Allow WinRM HTTPS" $fwtest2 = netsh advfirewall firewall show rule name="Allow WinRM HTTPS" profile=any If ($fwtest1.count -lt 5) { Write-Verbose "Adding firewall rule to allow WinRM HTTPS." netsh advfirewall firewall add rule profile=any name="Allow WinRM HTTPS" dir=in localport=5986 protocol=TCP action=allow } ElseIf (($fwtest1.count -ge 5) -and ($fwtest2.count -lt 5)) { Write-Verbose "Updating firewall rule to allow WinRM HTTPS for any profile." netsh advfirewall firewall set rule name="Allow WinRM HTTPS" new profile=any } Else { Write-Verbose "Firewall rule already exists to allow WinRM HTTPS." } # Test a remoting connection to localhost, which should work. $httpResult = Invoke-Command -ComputerName "localhost" -ScriptBlock {$env:COMPUTERNAME} -ErrorVariable httpError -ErrorAction SilentlyContinue $httpsOptions = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck $httpsResult = New-PSSession -UseSSL -ComputerName "localhost" -SessionOption $httpsOptions -ErrorVariable httpsError -ErrorAction SilentlyContinue ## Disable HTTP Listener --Roger If ($httpResult) { winrm delete winrm/config/Listener?Address=*+Transport=HTTP } If ($httpResult -and $httpsResult) { Write-Verbose "HTTP: Enabled | HTTPS: Enabled" } ElseIf ($httpsResult -and !$httpResult) { Write-Verbose "HTTP: Disabled | HTTPS: Enabled" } ElseIf ($httpResult -and !$httpsResult) { Write-Verbose "HTTP: Enabled | HTTPS: Disabled" } Else { Throw "Unable to establish an HTTP or HTTPS remoting session." } Write-Verbose "PS Remoting has been successfully configured for Ansible."

注意：HTTPS认证需要创建证书，但是证书的有效期为一年，所以为了保证证书不过期，可以做一个计划任务的脚本，在windows主机每次重启时，执行这个脚本，这个每次重启后的证书是新的。

本文转自曾哥最爱 51CTO博客，原文链接：http://blog.51cto.com/zengestudy/1865946，如需转载请自行联系原作者

推荐文章：

Ansible控制Windows操作步骤，