python – WinRM – 服务器拒绝指定的凭据
内容导读
互联网集市收集整理的这篇技术教程文章主要介绍了python – WinRM – 服务器拒绝指定的凭据，小编现在分享给大家，供广大互联网技能从业者学习和参考。文章包含3756字，纯文字阅读大概需要6分钟。
内容图文
我无法在python脚本中获取WinRM会话.
环境
ad-dns.test.com - Windows 2012 AD and DNS Server
box88.test.com - CentOS 7.2 : Kerberos, Python (Not joined to domain)
box62.test.com - Windows 2012 R2 Standard (Joined to domain)
box63.test.com - Windows 10 (Joined to domain)
配置
我通过ConfigureRemotingForAnsible.ps1 PowerShell脚本在Windows 10和2012服务器上启用了WinRM.这些是WinRM配置.
PS C:\Windows\system32> winrm get winrm/config
Config
MaxEnvelopeSizekb = 500
MaxTimeoutms = 60000
MaxBatchItems = 32000
MaxProviderRequests = 4294967295
Client
NetworkDelayms = 5000
URLPrefix = wsman
AllowUnencrypted = false
Auth
Basic = true
Digest = true
Kerberos = true
Negotiate = true
Certificate = true
CredSSP = false
DefaultPorts
HTTP = 5985
HTTPS = 5986
TrustedHosts = *
Service
RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
MaxConcurrentOperations = 4294967295
MaxConcurrentOperationsPerUser = 1500
EnumerationTimeoutms = 240000
MaxConnections = 300
MaxPacketRetrievalTimeSeconds = 120
AllowUnencrypted = false
Auth
Basic = true
Kerberos = true
Negotiate = true
Certificate = false
CredSSP = false
CbtHardeningLevel = Relaxed
DefaultPorts
HTTP = 5985
HTTPS = 5986
IPv4Filter = *
IPv6Filter = *
EnableCompatibilityHttpListener = false
EnableCompatibilityHttpsListener = false
CertificateThumbprint
AllowRemoteAccess = true
Winrs
AllowRemoteShellAccess = true
IdleTimeout = 7200000
MaxConcurrentUsers = 10
MaxShellRunTime = 2147483647
MaxProcessesPerShell = 25
MaxMemoryPerShellMB = 1024
MaxShellsPerUser = 30
PS C:\Windows\system32>
我已经准备好了CentOS盒子如下
# yum -y install python-pip python-devel krb5-devel krb5-libs krb5-workstation
# pip install --upgrade pip
# pip install "pywinrm>=0.1.1" kerberos pykerberos requests-kerberos isodate xmltodict
# cat /etc/krb5.conf
[libdefaults]
default_realm = TEST.COM
[realms]
TEST.COM = {
kdc = ad-dns.test.com
admin_server = ad-dns.test.com
kpasswd_server = ad-dns.test.com
default_domain = test.com
}
[domain_realm]
.test.com = TEST.COM
test.com = TEST.COM
#
# kinit vkumar@TEST.COM
Password for vkumar@TEST.COM:
# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: vkumar@TEST.COM
Valid starting Expires Service principal
2016-06-30T02:15:20 2016-06-30T12:15:20 krbtgt/TEST.COM@TEST.COM
renew until 2016-07-01T02:15:16
#
问题
到现在为止,一切都很顺利.当我尝试使用此kerberos票证使用以下脚本验证Windows服务器时,会出现此问题.
#!/usr/bin/env python
import winrm
s = winrm.Session('box63.test.com', auth=('vkumar@TEST.COM', 'IamUsingKerbTicket'), transport='kerberos')
r = s.run_cmd('ipconfig', ['/all'])
print r.status_code
print r.std_out
print r.std_err
# ./winrm_ipconfig.py
Traceback (most recent call last):
File "./winrm_ipconfig.py", line 6, in <module>
r = s.run_cmd('ipconfig', ['/all'])
File "/usr/lib/python2.7/site-packages/winrm/__init__.py", line 37, in run_cmd
shell_id = self.protocol.open_shell()
File "/usr/lib/python2.7/site-packages/winrm/protocol.py", line 132, in open_shell
res = self.send_message(xmltodict.unparse(req))
File "/usr/lib/python2.7/site-packages/winrm/protocol.py", line 207, in send_message
return self.transport.send_message(message)
File "/usr/lib/python2.7/site-packages/winrm/transport.py", line 179, in send_message
raise InvalidCredentialsError("the specified credentials were rejected by the server")
winrm.exceptions.InvalidCredentialsError: the specified credentials were rejected by the server
#
不确定,为什么我在Windows服务器上的事件日志显示成功时看到此错误.显然,我看到同时发生了三次登录和注销.
不知道我在这里缺少什么.在CentOS和& ;;上停止/禁用防火墙Windows机器和时间也同步.
解决方法:
最后解决了它,这是一个权限问题,而不是日志中指出的无效凭据.这个问题有两种解决方案
>将域用户添加到Domain Admins Group
>在Windows服务器上执行winrm configSDDL默认值,并检查读取和执行权限,如下所示
内容总结
以上是互联网集市为您收集整理的python – WinRM – 服务器拒绝指定的凭据全部内容，希望文章能够帮你解决python – WinRM – 服务器拒绝指定的凭据所遇到的程序开发问题。 如果觉得互联网集市技术教程内容还不错，欢迎将互联网集市网站推荐给程序员好友。
内容备注
版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 gblab@vip.qq.com 举报，一经查实，本站将立刻删除。
内容手机端
扫描二维码推送至手机访问。