Ascender Windows quick start

very top you're going to have a name telling you this is what we're actually trying to do inside this Playbook underneath that we have our host and then we have some variables and then we have our task uh you'll see we have two different tasks on here one for installing IIs one for creating the IIs bindings we use the win feature module so it's in the ansible windows community so we use the win feature module to install the web server and then we actually set up a SSL port on IIs from failure but it's not too different than what you do with pretty much any

other Playbook or convincible ansible can work if anything and it works with everything virtually the same way so the one thing about dance ansible for Windows those ansible is originally written for a Linux you know it was developed to connect to the Linux so that's because of that every single variable behind it every single connection type defaults to all the Linux stuff so the networking and the windows stuff were added later and so we have to basically change all these different variables over here to say hey we're not connecting over SSH we're not connecting uh with this root user or anything else we're connecting to

winner realm over these very specific ports to connect with to Windows so the five different variables you typically use are these we have our ansible connection that's basically where we tell it we're not using the SSH we need to use one around and then we have an example Port one by default on Linux this is going to be Port 22. uh we need to change that to either 5985 or 59.86 once the unsecured Port once a secure port and we'll talk a little bit about why you would want to use either one of the others then we have a certificate one if you don't have

valid search on your win or own server most people don't I've actually rated my last seven years I probably ran into maybe two or three organizations out there that actually use valid search on every single server uh most people don't so we tell that to ignore that cert validation they're all the self-signed for the most part uh then we have the winner of Transport this is going to be the one of the important ones this is what basically is told of what authentication method to use there are five different ones that we're going to talk about and if we happen to use the Kerberos when

we need that very last variable which is set in a delegation flag we'll talk about why on that so our five different authentication methods are basic ntlm certificate credit SSP and Kerberos so by default two of these are enabled going around pretty much every single box is going to be in tlm or Kerberos basic itself is completely unencrypted now the thing about the winner protocol is you have an authentication method and then you have the winner on protocol itself the winner protocol itself is always encrypted it doesn't matter what authentication method you use the protocol is always encrypted but the authentication method may not be

if you're using basic that's basically sending um your credentials over the wire to win a realm basically easy in to unencrypt you know not really encrypted you do not want to be using this uh most organizations won't allow you to it and you have to enable two different settings to even allow you to do this you have to tell it to allow basic and to allow unencrypted uh we didn't have ntl ntlm is on by default it hashes it but it's very weak so again it's not one you want to use in every day but it is available and it's very important that it's enabled

by default because we're going to use this later to connect in and actually set everything else up we want you didn't have certificate certificate itself I don't really see any organizations out there using it is actually used as user certificates so you have to basically set up a user in a set up a certificate for that user on every single server you have to make sure they're rotated they don't expire all that sort of stuff within there it is really a pain to use the one company I saw that really tried to go all in on the specific one gave it about six months and

then they stopped they just move back to the normal stuff uh we didn't have the two higher level ones which are credit SSP so this is basically um it wraps it all in a TLS tunnel so you have basically inclus or Kerberos and it wraps in the TLs Tuttle and it goes over the secured Port it has to go over to secured Port the other three that I just talked about can go over the unsecured or technically have to go into the secure for the most part um the credit SP one has to go over the secure Port itself uh we also have Kerberos now

Kerberos itself it has to be on a domain to use Kerberos uh what's happened is there we're not really passing the username password anymore we're connected to uh doing a candidate connecting over to active directory pulling down a ticket and passing the kerbos ticket ID credits is p and Kerberos are considered uh one is to fix the double hop scenario so if you don't know what the double hop scenario is and when a realm or in Windows itself it's basically where I'm connecting in with one around I connect to the server I pass say my say on the ntlm I pass my one-way hash to

the server it gets that I'm authenticated to the server but then there are certain things I need to do like connect to a file share on a different server from that server to pull over installer well it's not caching those credentials to pass that along to the other server so it tries to authenticate as Anonymous which then you know fails so that's what's considered the double hop is where I have to connect to this server and then from there to something else I need to be able to pass those credentials in in a secure way to where I can pass that along to the next

server so credises P kind of fixes that now there are some insecurities with it and the fact that it is storing it on a local credential store on the machine so if you are on that machine and get it right at the right time you can actually pull those credentials out in a you know depending on what you use is ntlm and it's less secure then you can decrypt it um a little bit of hacking on there but for the most part you know it's stored in a credential store and then it passes it along to the secondary thing kirgos has the same thing the

key with kerberoso is your active directory's main has to allow first of all you have to have that delegation flag set on the bottom down there so that current roast delegation if you don't have that then it's not going to try to get a proper certificate that allows a multiple machine access because by default that keros ticket would get saying I'm allowed to connect with this user to this machine and that's it that's where that keros ticket gives us that way you know if someone else gets that kurros ticket they can't really do much with any other machines with it it can only connect to

that machine but when you have that delegation flag it's basically saying okay I need a ticket for a user that can connect to any machine so that it can pass that along and I can connect over to a fox share or elsewhere using those Kerberos authentication so again that is itself considered not as secure because again I have this ticket but you know you're kind of weighing the risk I got to do automation I got to be able to pass in credentials you know where what is my biggest risk what's my lowest risk uh what can I actually um you know use but these are

the five authentication methods in itself pretty much everybody out there today uses Kerberos our credit SSP so you're using Kerberos if it's on domain they use credits of Pete is not under the main uh within here they'll use ntlm to then set up so basically by default into alarms on so they'll connect in over the unsecured Port because by default the unsecured port's on detective ntlm and say okay I need to join the server to domain we'll join to the server with the domain with ansible once it gets on the domain then it'll swap over to either the secured port or and swap over to

curb rooms now there are reasons why you may want to use Kerberos with the unsecured port and I'm seeing mostly organizations out there today are using that because again the kergles itself is fairly encrypted as far as this Authentication Protocol has only allowed me to connect to this one machine with it you're not going to do much with that ticket ID the secured Port itself requires a little bit of setup you have to set up search you have to do a lot of stuff on there unless you're doing self sign so a lot of companies don't want to enable that secured port and instead they

use Kerberos over the unsecured Port because the winter protocol itself is already encrypted so when you stick it over the secured Port you're doing an encryption on encryption you know where's the benefit of that so I'm seeing a lot of companies out there today the new interlium setup credits P if it's not on the domain it's LM and then set up get it on the domain and use Kerberos if it is on Main so that's the five different authentication methods out there um yeah let me let me ask you a question about it so you said uh when RM is encrypted which is great do

you know when the authentication process happens does it authenticate first and then start passing traffic okay so that that really does make it important like for like basic or ntlm that authentication is going to happen not through the winrm tunnel but that's going to happen just over the wire and then when RM gets set up and yeah I mean with one room itself you can think of what you're really doing in HTTP protocol so you're sending that credentials you're sending it first okay so yeah that was that was a that was a kind of a key point that I even myself I was a little

unsure about because I was thinking well if this is a secure tunnel it it shouldn't matter right if you're using kind of Intel M or basic because it would be over over that encrypted tunnel but it's not so that happens yeah all right excellent yeah and then from that so these variables you have here you're generally going to set them up in a group inside your ansible so I see a lot of people they try to put these at the beginning of their playbook and there's sometimes I will do that so like for instance my playbook I use for setting up the server to get

it on the domain I put my variables at the front because I'm specifically telling it I want to use Kerberos but again I want to force that within the Playbook or sorry you can't see only on because I want to force that in the Playbook because I'm connecting it in a realm but then inside my inventory I have a group say called windows that I then stick my variables on there and have Kerberos because everything on my domain everything in my network is on my domain so then I'm always connecting in forcing that Kerberos connection anytime I connect within them I just override at the

Playbook level for my provisioning playbook yeah and that's an excellent point right so you shouldn't be putting these variables in every Playbook even then in your inventory you have multiple places you can put variables right you shouldn't be putting them right on an individual host right yeah do it as some type of group level so I generally just create I may have two different groups within there I may have a Windows group and then I'll have a Windows non-domain group just since it's the minority and then throws things in there for you know credit SSP etc for connecting those type of servers but for the

most part you know all this stuff this goes in a group and then I just apply that group to all my servers or when I pull it down from say a VMware I actually have that group in there until it override so it makes it pretty handy all right so one last one last tip uh security teams are going to see these authentication methods right they're going to say oh certificate based uh we would definitely want to use that what what ammunition can you give our our Ops Engineers here uh to hand over to Security team that says hey certificates uh a bad idea that

you're just going to have a bad time like what's the best way of explaining to them I would say the best way explaining is just the amount of work required versus the amount of extra security you get from it you know it's not really a lot there I mean really I would probably say lean more towards telling them hey well certificate yes but if this account gets expired or say this certificate gets you know uh promised that means I have to go to every single machine individually and change that certificate out versus these Kerberos it's a single flip you do as an active directory that

would be the biggest thing usually the biggest fight is not with say the certificate one well if your security team's the biggest fight is they want to run everything over secure port and just the amount of effort it takes to set that up and set up certificates with you know the CA and everything else it's just a big headache to get all that to work when really uh and there's a page on Microsoft's website that shows all this that hey this is already encrypted the winner protocol is already encrypted so as long as you're using a secure authentication going over the default unsecured Port is

perfectly fine according to Microsoft right awesome well Jimmy uh this was awesome as always enlightening and I always learned something new every time I hear you talk so I would encourage everybody every time you see Jimmy doing something please join in so uh thanks bud and we'll see you again soon yep all right and again thank you Jimmy so let's get started so first things first I've got a Windows host and I need to add it to an inventory right inventory is going to be a big list of all the things I could potentially operate against so typically I'm going to go to add and

add inventory and that will create an inventory I've already created one for this lab so I'm just going to show it to you really quick the next thing we do once we have created the inventory is we need to add host to it so you see I've got a couple of hosts in here and I'll click on this one specifically because this is the one that my playbook's going to be operating against so if I click edit it actually allows me to change things so if I click add and then add a host this is the menu I'm presented with I will give it a

name so Greg win is one and theoretically if that name is fully qualified and you know I so basically what happens is Ascender will fire the Automation and then it will try and look up the name of each host right if it is fully qualified we're done it doesn't have to do anything else but mine are just in a lab environment they aren't so I add something called the magic variable and a magic variable is one that is just known to ansible and it has a special purpose and this one is ansible underscore host that says hey if I've got this variable created for

an individual host inside of an inventory use this IP address so I've done that now technically we are done adding that host but as Jimmy told you we actually have to add some additional variables to tell ansible to connect to this thing because by default that's going to assume it is a Linux server and that is absolutely not how we're going to be connecting here because we're going to be doing it via win RM rather than SSH so we can add those variables at the top level of the inventory itself and so this one is for Windows host only so that actually would be a

viable option but more traditionally you're going to create a group say right here I've got Windows group and I'm going to add those variables into the group itself right and then I'll go under the group it's right group then we go into hosts and I've added those individual hosts but for this group Windows right here you can see I've got the connection type I'm telling it it's when RM rather than SSH I'm setting up the schema stuff I should be using transport of cred SSP or potentially Kerberos here I'm using ntlm and remember Jimmy talked about you can start with nclm because that's on by

default and then connecting to the host configure the Kerberos right so you could add it to the domain and then switch over to Kerberos whatever you need to do but for just this demo I'm just going to be using ntlm really quick so now any of those hosts are going to inherit all of these variables we're good to connect next thing we do is we add a project so let's add and then you just fill in the blanks right here right I'll give it a name I'll choose git which is going to tell it hey this is pulling from a git repository and again a

project is how you pull in all of your playbooks your templates right all of your accoutrement associated with your automation you're trying to run right here you're just going to put in the source control URL and then the credential to log into it I've actually already got one right here Greg sold windows again I'm going to have a blog post that's going to outline most of these details so don't worry overly much about trying to screen scrape everything you're seeing here we'll have some stuff associated with it but here you can see I just put in my public get repo that's why there is no

Source control credential because it's up into the public you can grab all this stuff as you want so as soon as I add that it's going to synchronize which means it's going to pull in all those materials and then we're good next credentials how are we logging into this thing so I created a machine credential and again it's add credential you choose machine you fill in the blanks for mine I am just doing the administrator and then with a password right you've got all these extra options you can change privilege escalation mission to run as for a Windows host if you want to once we

have that credential we're done as far as logging into the machine now the automation I'm running here actually does something pretty interesting so it's connecting to my VMware environment and doing something special so I had to add an additional credential in here so I've created a custom credential that means you can create a credential type down here in credential types that allow you to prompt the user for any kind of information you want you can designate certain things at secret now that information will get pushed into say either the execution environment like as you're running the automation it'll go in as an environment variable or

generally what I do is I pass that information in as an extra variable at runtime right so it'll it'll just pull in and overwrite any other variables that maybe have that exact same name but ultimately it's just in there and I can utilize it so I've got my VMware Server Connection credentials right there as well next we're going to go to the template section this is where we bring it all home all those you know constituent pieces kind of come together so I've created and again it's add job template so I've created a job template called Windows update with snapshots so I'm going to click

edit in this one I've given it a name I chose the inventory which is my Windows lab inventory I chose the project remember which is our git repository it's going to pull all that stuff in and then I chose the proper playbook in there when updates next I went to credentials I added my VMware Cloud so really I went into generic credential and I added the VMware server so I've got that I wanted to actually add a machine credential so then I just hit the plus and it defaults to machine right there and then I chose the windows administrator it said select and it populates

those two boxes after that I added some extra variables to my playbook right here that's going to get passed in as extra vars and what extra vars are are those that are injected at runtime have the highest level of Precedence so it's going to override anything that's in that Playbook next I click save and I'm ready to run this Playbook it's really just that fast so I'm going to go ahead and click launch and while it does that I'm going to pop over to the Playbook itself I'm going to give you a quick breakdown of what's going on so in the Playbook again in a

public repository so all this is available to you you can see up at the top I have the vars section so these are just going to be extra variables that I can put in here and generally I'm overriding all of these at runtime now why do I even put them up there if I'm just going to override them all if you have all of your variables at the top in the VAR section it's kind of easier to remember what's there and available for you to change so it's really just kind of a nice to have now what this Playbook is ultimately doing as it's doing

updates on a Windows server but it's doing it in an interesting way the very first thing it does is it uses the community.vmware.vmguest snapshot module right and so what it's doing is it's connecting in and it's taking a snapshot of this machine next it's going to pop down here into a block and a block is just kind of chunk of modules that are going to be running on them on their own or or tasks more specifically a task that actually fire off modules but what it's doing right here is it's going to do the Windows update here I have it State search so it's just

going to do more like a check mode it's just kind of look up in a real environment you would have it actually make your adjustments in there the next cool thing is if these updates fail for any reason it hits this rescue section and guess what it does it rolls back the snapshot so it undoes all the changes you just did and then if it completes successfully it'll go ahead and delete the snapshot as well right so it actually comes back in and does clean up I've got it in here a couple of debug messages for showing you if you did have a monitoring system

you could actually previous to making these updates you could have it put it into maintenance mode and then pull it out of maintenance mode kind of gives you some options there all right now that I've popped back over to Ascender you can see that the Playbook has completed and I'm going to take a look here and I can see all of my outputs so I can see create the snapshot you can see it says change that means it actually made an adjustment there's this concept of item potency inside of Ascender all right in ansible itself and the idea is I'm really defining state I'm

saying make whatever this thing is look like this if it looks like that do nothing you'll see the green where it just says okay I didn't actually do anything I didn't make any changes if it looks and says the state needs to look like this and it doesn't it will actually make the adjustment and it'll say changed right really cool key function of using ansible with Ascender here now any of these things that say change I can go in and I can click them and it will give me additional information right very different than running things on the command line it'll actually tell me

very specifically what's going on there so the updates if I was actually applying these this would be orange and changed but for now now since it's in the exact mode it's in now where it's more just kind of a check mode I can click on it I can see all of the updates right that were security specific that I would have installed so as you can see you can get up and moving doing some really functional things in Windows servers very quickly if you have any questions or comments or your tweak or tune this I would love to hear about it um if you have

any questions about Ascender itself we'd love to hear from you as well and if nothing else happy windowing happy ascending and we'll see you next time bye