knife ssl verify/fetch should work with self-signed certificates for winrm hosts #284
Comments
|
I'd think that we would want to make this the default for test-ktichen and any other chef-provisioning drivers that support windows, but we'd need to update the equivalent user_data everywhere. I created chef-boneyard/chef-provisioning-aws#317 to for chef-provisioning, might create tickets for knife and test-kitchen as well. |
|
Cross post from http://lists.opscode.com/sympa/arc/chef/2015-09/msg00289.html My goal is to securely connect to windows boxes from chef-provisioning (aws), I noticed that even after the knife ssl fetch, knife refuses to use knife ssl check/fetch/check followed by openssl s_client check: |
|
I also put together some info for getting windows to offer up winrm over ssl using the self-signed rdp certificate (cross post http://lists.opscode.com/sympa/arc/chef/2015-09/msg00290.html) On boot ec2 windows instances print a lot of useful stuff to the aws The instance comes up with knife winrm complaining about certs (Comment above this one at #284 (comment)) , and it I'm not sure where I would look in chef-provisioning-aws to I include some user_data, chef-provisioning recipe, and console output <powershell>
winrm quickconfig -q
winrm set winrm/config/winrs '@{MaxMemoryPerShellMB="300"}'
winrm set winrm/config '@{MaxTimeoutms="1800000"}'
netsh advfirewall firewall add rule name="WinRM 5986" protocol=TCP
dir=in localport=5986 action=allow
$SourceStoreScope = 'LocalMachine'
$SourceStorename = 'Remote Desktop'
$SourceStore = New-Object -TypeName
System.Security.Cryptography.X509Certificates.X509Store -ArgumentList
$SourceStorename, $SourceStoreScope
$SourceStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadOnly)
$cert = $SourceStore.Certificates | Where-Object -FilterScript {
$_.subject -like '*'
}
$DestStoreScope = 'LocalMachine'
$DestStoreName = 'My'
$DestStore = New-Object -TypeName
System.Security.Cryptography.X509Certificates.X509Store -ArgumentList
$DestStoreName, $DestStoreScope
$DestStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
$DestStore.Add($cert)
$SourceStore.Close()
$DestStore.Close()
winrm create winrm/config/listener?Address=*+Transport=HTTPS
`@`{Hostname=`"($certId)`"`;CertificateThumbprint=`"($cert.Thumbprint)`"`}
net stop winrm
sc config winrm start=auto
net start winrm
</powershell>with_machine_options bootstrap_options: {
winrm_transport: {
https: {
# This is what I'd prefer not to do, still doesn't connect
no_ssl_peer_verification: true
}
},
user_data: setup_winrm_ssl_user_data_from_above,
image_id: 'ami-7bc3e04b'
# aws-marketplace/CIS Microsoft Windows Server 2012 R2
# Benchmark v1.1.0-26bb465c-ce26-4da9-afb8-040b2f8c9a7f-ami-7a88f312.2
}
machine_name = 'win-2012-hardened-X'
m = machine "#{machine_name}" do
action :allocate
end
ruby_block "Security Info on #{machine_name}" do
block do
# wait for the machine to be in a ready state
mr=resources(machine: machine_name).provider_for_action(:ready)
mr.load_current_resource
machine=mr.action_ready
# grab a pointer to the chef-provisioning driver
# so we can call driver.config and driver.ec2.*
driver = node.run_state[:chef_provisioning].drivers.values.first
i=driver.ec2.instances[machine.machine_spec.reference['instance_id']]
# check for rdp certificate fingerprint
i.console_output.lines.each do |l|
Chef::Log.warn l.chomp
end
# just to look ot the machine_spec
machine.machine_spec.reference.pretty_inspect.lines.each do |l|
Chef::Log.warn l.chomp
end
# decrypt the password
pem = Cheffish.get_private_key(machine.machine_spec.reference['key_name'],
driver.config)
private_key = OpenSSL::PKey::RSA.new(pem)
encrypted_admin_password =
driver.wait_for_admin_password(machine.machine_spec)
decoded = Base64.decode64(encrypted_admin_password)
decrypted_password = private_key.private_decrypt decoded
Chef::Log.warn "knife ssl fetch https://#{i.private_ip_address}:5985";
Chef::Log.warn "rdesktop -u Administrator -p
'#{decrypted_password}' -g 1280x800 #{i.private_ip_address}"
Chef::Log.warn "knife winrm --winrm-port 5986 --winrm-transport ssl
--winrm-password '#{decrypted_password}' -m #{i.private_ip_address}
hostname"
# a nice place to rest until we get figure out how to get winrm +
ssl working
# TRY RUNNING 'knife winrm' HERE **************************************************
byebug
# as execution won't work until we configure winrm to actually
communicate to the node
machine.execute_always('dir "cert:\localmachine\Remote
Desktop"').stdout.lines.each do |l|
Chef::Log.warn l.chomp
end
end
end
# someday!
machine "#{machine_name}" do
action :converge
endfull ec2-get-console, there is an ec2config issued reboot to get a |
|
https://github.com/chef/knife-windows/blob/master/lib/chef/knife/winrm_knife_base.rb#L194 notes that we should use ssl certificates, but we are unable to set it to do so |
|
I think this is similar enough to #298 with --ssl-peer-fingerprint that we should probably just update the documentation to generate the fingerprint to pass to it. |
|
We'd have to have a mapping from hosts to fingerprint... which would make sense to just store in the node, so we have either a fingerprint or pem encoded certificate as a particular node attribute? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I'm trying to make it so chef-provisioned windows nodes can communicate safely via winrm over ssl and verify the certificate.
chef-boneyard/chef-provisioning-aws@59ebd0e#commitcomment-13137801
The first step would be to make sure that ``knife ssl fetch/check https://windowshost:5966 works, but I'm running into errors around self-signed certificates.
The text was updated successfully, but these errors were encountered: