ChefDK - WinRM switching to basic auth when Domain credentials are provided.

Question

I'm using ChefDK 0.3.5 on Windows 7 64bit. I'm having a bit of a problem trying to use Chef and WinRM to execute the chef-client command on a remote server. The command I'm issuing is below:

C:\U\user1> knife winrm "fqdn:testserver.*" "netstat" -x 'domain\user1' -P 'password'
WARNING: Switching to Negotiate authentication, Basic does not support Domain Authentication
ERROR: RuntimeError: Error: Unencrypted communication not supported. Please check winrm configuration winrm/config/service AllowUnencrypted flag.

The result I got doesn't let me do what I want. So I googled it, and saw something about not verifying SSL, or using :verify_peer, which did nothing as well. So I executed the WinRM configuration commands again, in Command Prompt, because PowerShell tells me their wrong.

C:\Users\user1>C:\WIndows\System32\cmd.exe /c winrm set winrm/config/winrs @{MaxMemoryPerShellMB="300"}
Winrs
    AllowRemoteShellAccess = true
    IdleTimeout = 7200000
    MaxConcurrentUsers = 10
    MaxShellRunTime = 2147483647
    MaxProcessesPerShell = 25
    MaxMemoryPerShellMB = 300
    MaxShellsPerUser = 30


C:\Users\user1>C:\WIndows\System32\cmd.exe /c winrm set winrm/config @{MaxTimeoutms="1800000"}
Config
    MaxEnvelopeSizekb = 500
    MaxTimeoutms = 1800000
    MaxBatchItems = 32000
    MaxProviderRequests = 4294967295
    Client
        NetworkDelayms = 5000
        URLPrefix = wsman
        AllowUnencrypted = false
        Auth
            Basic = true
            Digest = true
            Kerberos = true
            Negotiate = true
            Certificate = true
            CredSSP = false
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        TrustedHosts
    Service
        RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;G
XGW;;;WD)
        MaxConcurrentOperations = 4294967295
        MaxConcurrentOperationsPerUser = 1500
        EnumerationTimeoutms = 240000
        MaxConnections = 300
        MaxPacketRetrievalTimeSeconds = 120
        AllowUnencrypted = true
        Auth
            Basic = false
            Kerberos = true
            Negotiate = true
            Certificate = false
            CredSSP = false
            CbtHardeningLevel = Relaxed
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        IPv4Filter = *
        IPv6Filter = *
        EnableCompatibilityHttpListener = false
        EnableCompatibilityHttpsListener = false
        CertificateThumbprint
        AllowRemoteAccess = true
    Winrs
        AllowRemoteShellAccess = true
        IdleTimeout = 7200000
        MaxConcurrentUsers = 10
        MaxShellRunTime = 2147483647
        MaxProcessesPerShell = 25
        MaxMemoryPerShellMB = 300
        MaxShellsPerUser = 30


C:\Users\user1>C:\WIndows\System32\cmd.exe /c winrm set winrm/config/service@{AllowUnencrypted="true"}
Service 
  RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;
;;WD)
    MaxConcurrentOperations = 4294967295
    MaxConcurrentOperationsPerUser = 1500
    EnumerationTimeoutms = 240000
    MaxConnections = 300
    MaxPacketRetrievalTimeSeconds = 120
    AllowUnencrypted = true
    Auth
        Basic = false
        Kerberos = true
        Negotiate = true
        Certificate = false
        CredSSP = false
        CbtHardeningLevel = Relaxed
    DefaultPorts
        HTTP = 5985
        HTTPS = 5986
    IPv4Filter = *
    IPv6Filter = *
    EnableCompatibilityHttpListener = false
    EnableCompatibilityHttpsListener = false
    CertificateThumbprint
    AllowRemoteAccess = true

After executing these commands, I try again, and ChefDK looks at me like I'm stupid. I'm not sure why Chef is trying to use basic auth then I give it domain credentials. This also worked previously, but I had to get a new computer and my notes, and installations were lost. Are there any ideas on what I could be missing? If I'm missing any information let me know and I'll update my question.

`knife ssh "fqdn:server.*" "chef-client" -x "user" -P "password` works just fine though. — FilBot3, Jan 02 '15 at 21:07

score 0 · Answer 1 · answered May 08 '15 at 23:44

The client command tells you:

Unencrypted communication not supported. Please check winrm configuration winrm/config/service AllowUnencrypted flag.

Your configuration, as printed out from the result of the timeout command, tells you:

Config
    MaxEnvelopeSizekb = 500
    MaxTimeoutms = 1800000
    MaxBatchItems = 32000
    MaxProviderRequests = 4294967295
    Client
        NetworkDelayms = 5000
        URLPrefix = wsman
        AllowUnencrypted = false

You need to set the AllowUnencrypted flag to true, by running the command:

winrm set winrm/config/service @{AllowUnencrypted="true"}

The latest github versions of knife-windows add commands for creating ssl certs and tightening up your connection, which you will hopefully want to do when you're ready.

ChefDK - WinRM switching to basic auth when Domain credentials are provided.

1 Answers1