Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix for Winrm Authentication Failure issue during bootstrap #435

Merged
merged 6 commits into from
Aug 2, 2016
Merged

Fix for Winrm Authentication Failure issue during bootstrap #435

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3efe84f
Added local user account into the Administrators group
dheerajd-msys Jul 27, 2016
4f95178
Added checks during adding of local user to administrator group
dheerajd-msys Jul 28, 2016
1c5f2d2
Fixed existing specs
Jul 28, 2016
919e6c2
Added specs
dheerajd-msys Jul 28, 2016
eb92a91
Updated code and specs based on review comments
dheerajd-msys Jul 29, 2016
3b46a5c
Updated Specs
dheerajd-msys Jul 29, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions lib/chef/knife/ec2_server_create.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -931,8 +931,16 @@ def eip_scope
end

def ssl_config_user_data
user_related_commands = ""
winrm_user = locate_config_value(:winrm_user).split("\\")
if (winrm_user[0] == ".") || (winrm_user[0] == "") ||(winrm_user.length == 1)
user_related_commands = <<-EOH
net user /add #{locate_config_value(:winrm_user).delete('.\\')} #{windows_password};
net localgroup Administrators /add #{locate_config_value(:winrm_user).delete('.\\')};
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suppose there isn't a circumstance where someone will be using this feature to bootstrap a server in a domain on ec2 over ssl, but it does seem like we should only being doing this step if we're given a local user.

EOH
end
<<-EOH

#{user_related_commands}
If (-Not (Get-Service WinRM | Where-Object {$_.status -eq "Running"})) {
winrm quickconfig -q
}
Expand All @@ -945,7 +953,7 @@ def ssl_config_user_data
$create_listener_cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"$vm_name`";CertificateThumbprint=`"$thumbprint`"}'"
iex $create_listener_cmd

netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=public enable=yes
netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=any enable=yes

EOH
end
Expand Down
81 changes: 74 additions & 7 deletions spec/unit/ec2_server_create_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1523,10 +1523,75 @@
end
end

describe 'ssl_config_user_data' do
before do
@knife_ec2_create.config[:winrm_password] = "ec2@123"
end

context 'For domain user' do
before do
@knife_ec2_create.config[:winrm_user] = "domain\\ec2"
@ssl_config_data = <<-EOH

If (-Not (Get-Service WinRM | Where-Object {$_.status -eq "Running"})) {
winrm quickconfig -q
}
If (winrm e winrm/config/listener | Select-String -Pattern " Transport = HTTP\\b" -Quiet) {
winrm delete winrm/config/listener?Address=*+Transport=HTTP
}
$vm_name = invoke-restmethod -uri http://169.254.169.254/latest/meta-data/public-ipv4
New-SelfSignedCertificate -certstorelocation cert:\\localmachine\\my -dnsname $vm_name
$thumbprint = (Get-ChildItem -Path cert:\\localmachine\\my | Where-Object {$_.Subject -match "$vm_name"}).Thumbprint;
$create_listener_cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"$vm_name`";CertificateThumbprint=`"$thumbprint`"}'"
iex $create_listener_cmd

netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=any enable=yes

EOH
end

it 'gets ssl config user data' do
expect(@knife_ec2_create.ssl_config_user_data).to be == @ssl_config_data
end
end

context 'For local user' do
before do
@knife_ec2_create.config[:winrm_user] = ".\\ec2"
@ssl_config_data = <<-EOH
net user /add ec2 ec2@123;
net localgroup Administrators /add ec2;

If (-Not (Get-Service WinRM | Where-Object {$_.status -eq "Running"})) {
winrm quickconfig -q
}
If (winrm e winrm/config/listener | Select-String -Pattern " Transport = HTTP\\b" -Quiet) {
winrm delete winrm/config/listener?Address=*+Transport=HTTP
}
$vm_name = invoke-restmethod -uri http://169.254.169.254/latest/meta-data/public-ipv4
New-SelfSignedCertificate -certstorelocation cert:\\localmachine\\my -dnsname $vm_name
$thumbprint = (Get-ChildItem -Path cert:\\localmachine\\my | Where-Object {$_.Subject -match "$vm_name"}).Thumbprint;
$create_listener_cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"$vm_name`";CertificateThumbprint=`"$thumbprint`"}'"
iex $create_listener_cmd

netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=any enable=yes

EOH

end

it 'gets ssl config user data' do
expect(@knife_ec2_create.ssl_config_user_data).to be == @ssl_config_data
end
end
end

describe 'ssl_config_data_already_exist?' do

before(:each) do
@user_user_data = 'user_user_data.ps1'
@knife_ec2_create.config[:winrm_user] = "domain\\ec2"
@knife_ec2_create.config[:winrm_password] = "ec2@123"
@knife_ec2_create.config[:aws_user_data] = @user_user_data
end

Expand Down Expand Up @@ -1566,7 +1631,7 @@
$create_listener_cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"$vm_name`";CertificateThumbprint=`"$thumbprint`"}'"
iex $create_listener_cmd

netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=public enable=yes
netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=any enable=yes

</powershell>

Expand All @@ -1592,6 +1657,8 @@
@knife_ec2_create.config[:ssh_key_name] = "ssh_key_name"
@knife_ec2_create.config[:winrm_transport] = "ssl"
@knife_ec2_create.config[:create_ssl_listener] = true
@knife_ec2_create.config[:winrm_user] = "domain\\ec2"
@knife_ec2_create.config[:winrm_password] = "ec2@123"
end

context 'when user_data script provided by user contains only <script> section' do
Expand Down Expand Up @@ -1628,7 +1695,7 @@
$create_listener_cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"$vm_name`";CertificateThumbprint=`"$thumbprint`"}'"
iex $create_listener_cmd

netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=public enable=yes
netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=any enable=yes

</powershell>
EOH
Expand Down Expand Up @@ -1675,7 +1742,7 @@
$create_listener_cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"$vm_name`";CertificateThumbprint=`"$thumbprint`"}'"
iex $create_listener_cmd

netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=public enable=yes
netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=any enable=yes

</powershell>
EOH
Expand Down Expand Up @@ -1715,7 +1782,7 @@
$create_listener_cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"$vm_name`";CertificateThumbprint=`"$thumbprint`"}'"
iex $create_listener_cmd

netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=public enable=yes
netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=any enable=yes

</powershell>
EOH
Expand All @@ -1737,7 +1804,7 @@
$create_listener_cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"$vm_name`";CertificateThumbprint=`"$thumbprint`"}'"
iex $create_listener_cmd

netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=public enable=yes
netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=any enable=yes

</powershell>
EOH
Expand Down Expand Up @@ -1821,7 +1888,7 @@
$create_listener_cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"$vm_name`";CertificateThumbprint=`"$thumbprint`"}'"
iex $create_listener_cmd

netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=public enable=yes
netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=any enable=yes

</powershell>
<script>
Expand Down Expand Up @@ -1862,7 +1929,7 @@
$create_listener_cmd = "winrm create winrm/config/Listener?Address=*+Transport=HTTPS '@{Hostname=`"$vm_name`";CertificateThumbprint=`"$thumbprint`"}'"
iex $create_listener_cmd

netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=public enable=yes
netsh advfirewall firewall add rule name="WinRM HTTPS" protocol=TCP dir=in Localport=5986 remoteport=any action=allow localip=any remoteip=any profile=any enable=yes

</powershell>
EOH
Expand Down