WinRM Connection Error

[Scott Garcia]

Trying to ping a windows machine, and I'm running into an ambiguous error from one of the python modules.  Any suggestion on how to fix this?

------------------

# ansible windows -i inventory -vvvv -m win_ping

ansible 2.6.2

  config file = /home/ec2-user/ansible.cfg

  configured module search path = [u'/usr/share/my_modules']

  ansible python module location = /home/ec2-user/venv/local/lib/python2.7/site-packages/ansible

  executable location = /home/ec2-user/venv/bin/ansible

  python version = 2.7.14 (default, May  2 2018, 18:31:34) [GCC 4.8.5 20150623 (Red Hat 4.8.5-11)]

Using /home/ec2-user/ansible.cfg as config file

setting up inventory plugins

Parsed /home/ec2-user/inventory inventory source with yaml plugin

Loading callback plugin minimal of type stdout, v2.0 from /home/ec2-user/venv/local/lib/python2.7/site-packages/ansible/plugins/callback/minimal.pyc

META: ran handlers

Using module file /home/ec2-user/venv/local/lib/python2.7/site-packages/ansible/modules/windows/win_ping.ps1

<10.206.46.246> ESTABLISH WINRM CONNECTION FOR USER: lanadmin on PORT 5985 TO 10.206.46.246

checking if winrm_host 10.206.46.246 is an IPv6 address

<10.206.46.246> WINRM CONNECT: transport=ntlm endpoint=http://10.206.46.246:5985/wsman

<10.206.46.246> WINRM CONNECTION ERROR: Parse() argument 1 must be string or read-only buffer, not None

Traceback (most recent call last):

  File "/home/ec2-user/venv/local/lib/python2.7/site-packages/ansible/plugins/connection/winrm.py", line 386, in _winrm_connect

    self.shell_id = protocol.open_shell(codepage=65001)  # UTF-8

  File "/home/ec2-user/venv/local/lib/python2.7/site-packages/winrm/protocol.py", line 161, in open_shell

    root = ET.fromstring(res)

  File "/usr/lib64/python2.7/xml/etree/ElementTree.py", line 1311, in XML

    parser.feed(text)

  File "/usr/lib64/python2.7/xml/etree/ElementTree.py", line 1657, in feed

    self._parser.Parse(data, 0)

TypeError: Parse() argument 1 must be string or read-only buffer, not None

windows | UNREACHABLE! => {

    "changed": false, 

    "msg": "ntlm: Parse() argument 1 must be string or read-only buffer, not None", 

    "unreachable": true

}

----------------------

# Inventory settings

ansible_host: 10.206.46.246

ansible_user: lanadmin

ansible_password: xxxxxx

ansible_port: 5985

ansible_connection: winrm

ansible_winrm_transport: ntlm

ansible_winrm_server_cert_validation: ignore

Attempts at a fix

1. I've tried changing the authentication type, but it just shows the same error message with that authentication type prepended.

2. I've ran the ConfigureRemotingForAnsible.ps1 script on my windows machine

3. I've tested the windows machine according to https://docs.ansible.com/ansible/2.5/user_guide/windows_setup.html#common-winrm-issues

[J Hawkesworth]

That's a new one on me, but I have a few suggestions of things you can try.

Try using a hostname instead of an ip address.

Try not running ansible from a venv (should be fine, but just peeling back a layer).

Check the event log on the target windows box (eventvwr.msc) and see if there is any evidence of a successful login from the lanadmin user.

Also, what version of windows are you targeting?  If I recall Server 2008/Server 2008R2 had some issues which are only fixed when SP1 is installed or its fully up to date with windows updates.

Try a complete uninistall and reinstall of ansible.

Hope this helps

Jon

[Jordan Borean]

Can you give us the output of pip list, seems like pywinrm is receiving a None value where it is expecting a string.

Thanks

Jordan

[John Roh]

I have the same issue that I rolled back to 2.4.1. 

I have updated the packer.py for the connection_plugsins from github and updated win_udpates from the github, both didn't worked at all. 

However, 2.4.1, I was able to create ami without having the winrm timeout along with packer v1.2.3.

Good luck.

John.

--
You received this message because you are subscribed to the Google Groups "Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ansible-project+unsubscribe@googlegroups.com.
To post to this group, send email to ansible-project@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/376a58de-64a9-4f38-96f1-09de04539358%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Jordan Borean]

John Roh, this would be unrelated to the packer issues. It is already known that Packer's connection plugin is problematic with connecting to Windows hosts due to how their architecture is set up.

Thanks

Jordan

[Scott Garcia]

# pip list

Package                      Version    

---------------------------- -----------

ansible                      2.6.2      

asn1crypto                   0.24.0     

backports.ssl-match-hostname 3.5.0.1    

bcrypt                       3.1.4      

cached-property              1.4.3      

certifi                      2018.4.16  

cffi                         1.11.5     

chardet                      3.0.4      

cryptography                 2.3        

docker                       3.4.1      

docker-compose               1.22.0     

docker-pycreds               0.3.0      

dockerpty                    0.4.1      

docopt                       0.6.2      

enum34                       1.1.6      

functools32                  3.2.3.post2

idna                         2.6        

ipaddress                    1.0.22     

Jinja2                       2.10       

jsonschema                   2.6.0      

MarkupSafe                   1.0        

ntlm-auth                    1.2.0      

paramiko                     2.4.1      

pip                          18.0       

pyasn1                       0.4.4      

pycparser                    2.18       

PyNaCl                       1.2.1      

pywinrm                      0.3.0      

PyYAML                       3.13       

requests                     2.18.4     

requests-ntlm                1.1.0      

setuptools                   40.0.0     

six                          1.11.0     

texttable                    0.9.1      

urllib3                      1.22       

websocket-client             0.48.0     

wheel                        0.31.1     

xmltodict                    0.11.0     

[Scott Garcia]

Same error is raised regardless of hostname, even if I put an erroneous one.  Event log shows an alert to an ntlm authentication but I can't find anything as far as a successful login  I'm targeting Server 2012R2. Ran a clean install and still run into the issue

[J Hawkesworth]

Ok a couple of other ideas...

See  if the s2012r2 target firewall is blocking traffic to/from port 5985

If I recall the configure for remoting script adds a rule for this but worth checking all the profiles.

Also worth checking for any firewalling on your ansible host as well while you are at it.

Try using pywinrm without ansible - see the code examples near the bottom of this page: https://github.com/diyan/pywinrm

Were you able to try without venv?

Jon

[naga venkatesh naidu]

+1
getting the same error, didn't get the solution yet.

 please post here if anyone resolved the following error.

pip list :

Package                      Version

---------------------------- ---------

ansible                      2.6.4

asn1crypto                   0.24.0

Babel                        0.9.6

backports.ssl-match-hostname 3.5.0.1

certifi                      2018.8.24

cffi                         1.11.5

chardet                      3.0.4

configobj                    4.7.2

cryptography                 2.3.1

decorator                    3.4.0

enum34                       1.1.6

httplib2                     0.9.2

idna                         2.7

iniparse                     0.4

ipaddr                       2.1.11

ipaddress                    1.0.22

javapackages                 1.0.0

Jinja2                       2.7.2

jmespath                     0.9.0

kitchen                      1.1.1

libvirt-python               3.9.0

lxml                         3.2.1

MarkupSafe                   0.11

ntlm-auth                    1.2.0

paramiko                     2.1.1

passlib                      1.6.5

perf                         0.1

pip                          18.0

ply                          3.4

pyasn1                       0.1.9

pycparser                    2.18

pycurl                       7.19.0

pygobject                    3.22.0

pygpgme                      0.3

pykerberos                   1.2.1

pyliblzma                    0.5.3

python-linux-procfs          0.4.9

pyudev                       0.15

pywinrm                      0.3.0

pyxattr                      0.5.1

PyYAML                       3.10

requests                     2.19.1

requests-kerberos            0.12.0

requests-ntlm                1.1.0

schedutils                   0.4

setuptools                   0.9.8

six                          1.11.0

slip                         0.4.0

slip.dbus                    0.4.0

SSSDConfig                   1.16.0

urlgrabber                   3.10

urllib3                      1.23

virtualenv                   15.1.0

wheel                        0.31.1

xmltodict                    0.11.0

yum-metadata-parser          1.1.4

ansible 2.6.4

  config file = /etc/ansible/ansible.cfg

  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']

  ansible python module location = /usr/lib/python2.7/site-packages/ansible

  executable location = /bin/ansible

  python version = 2.7.5 (default, Jul 13 2018, 13:06:57) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]

ansible windows -m win_ping -vvvv

 "changed": false,

    "msg": "kerberos: must be string or read-only buffer, not None",

    "unreachable": true

[J Hawkesworth]

Can you run 

ansible windows -m win_ping -vvvvv

This should return the stack trace.

My guess is one of your keberos-related dependencies is out of date.  Sometimes the kerberous libraries are installed with the operating system, so you may need to double check the dependencies you have installed.  See https://docs.ansible.com/ansible/2.3/intro_windows.html#installing-python-kerberos-dependencies

Jon

[Ankit Vashistha]

Try adding the following and recheck with ntlm

ansible_winrm_message_encryption: auto

--
You received this message because you are subscribed to the Google Groups "Ansible Project" group.

To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com.
To post to this group, send email to ansible...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/1acccdcf-c07d-430b-a921-1107e57e9f17%40googlegroups.com.

[naga venkatesh naidu]

Thank you @Hawkesworth.

Yeah this might be the dependensy issue with winrm on latest ansible version.

i worked absolutely fine when i used ansible 2.4.2.1 version with pywinrm[0.2.0] with basic authentication.

But kerberos authentication is not supported in that version.

[naga venkatesh naidu]

I will try this Ankit.

Thank you.