How to add Windows node on Rundeck server and Execute jobs using WinRM plugin

What is Rundeck?

Rundeck is an open-source software Job scheduler and Run Book Automation system for automating routine processes across development and production environments. It combines task scheduling, multi-node command execution, workflow orchestration and logs everything that happens.

In this tutorial, we are going to show you how to add a Windows host and manage it using the Rundeck Winrm plugin that uses WinRM to connect to Windows Hosts and execute commands with a Basic or Kerberos authentication over HTTP / HTTPS.
This tutorial assumes that you have already installed Rundeck, if you don’t have it installed yet, you can check out this tutorial : How to install and configure Rundeck on CentOS 7 / RHEL 7

 

Step 1./ Download and Install Rundeck Winrm plugin

– Go to following link here and download the last Rundeck Winrm plugin using the following command:

# wget https://github.com/rundeck-plugins/rundeck-winrm-plugin/releases/download/v1.3.4/rundeck-winrm-plugin-1.3.4.jar -P /var/lib/rundeck/libext/

– Make sure to change all the file under the /var/lib/rundeck/libext/ directory to the Rundeck user:

# chown -R rundeck. /var/lib/rundeck/libext/

– Restart the Rundeck daemon as below:

# /etc/init.d/rundeckd restart

Step 2./ Configure a Windows Server for WinRM

– On the remote host, open a PowerShell using the Run as Administrator option and execute the following commands to enable the WinRM :

PS C:\Users\Administrator.YALLALABS> winrm qc
WinRM already is set up to receive requests on this machine.
WinRM is not set up to allow remote access to this machine for management.
The following changes must be made:

Create a WinRM listener on HTTP://* to accept WS-Man requests to any IP on this machine.
Enable the WinRM firewall exception.

Make these changes [y/n]? y

WinRM has been updated for remote management.

Created a WinRM listener on HTTP://* to accept WS-Man requests to any IP on this machine.
WinRM firewall exception enabled.

PS C:\Users\Administrator.YALLALABS> winrm set winrm/config/service/Auth '@{Basic="true"}'
Auth
    Basic = true
    Kerberos = true
    Negotiate = true
    Certificate = false
    CredSSP = false
    CbtHardeningLevel = Relaxed

PS C:\Users\Administrator.YALLALABS> winrm set winrm/config/client/Auth '@{Basic="true"}'
Auth
    Basic = true
    Digest = true
    Kerberos = true
    Negotiate = true
    Certificate = true
    CredSSP = false

PS C:\Users\Administrator.YALLALABS> winrm set winrm/config/service '@{AllowUnencrypted="true"}'
Service
    RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
    MaxConcurrentOperations = 4294967295
    MaxConcurrentOperationsPerUser = 1500
    EnumerationTimeoutms = 240000
    MaxConnections = 300
    MaxPacketRetrievalTimeSeconds = 120
    AllowUnencrypted = true
    Auth
        Basic = true
        Kerberos = true
        Negotiate = true
        Certificate = false
        CredSSP = false
        CbtHardeningLevel = Relaxed
    DefaultPorts
        HTTP = 5985
        HTTPS = 5986
    IPv4Filter = *
    IPv6Filter = *
    EnableCompatibilityHttpListener = false
    EnableCompatibilityHttpsListener = false
    CertificateThumbprint
    AllowRemoteAccess = true    

– As we said before we will use Kerberos authentication means that we will use Windows domain accounts. we need to add a domain user account to the administrators group on the remote host.

Step.3/ Configure Kerberos on the Rundeck Server

– To use Windows domain accounts to access the remote host, we need to configure Kerberos on our Rundeck server, we have two options:

Kerberos authentication requires you to edit the kb5.conf file or to set up some Java System Properties in the /etc/rundeck/profile file to define which domains map to which Domain Controllers.

– In this example, we are going to configure the /etc/rundeck/profile file to define our Domain Controllers. Make sure to replace the values with the name of your domain/realm and the hostname of your domain controller as below.

# vi /etc/rundeck/profile
################# BEFORE ###################################
RDECK_JVM="-Drundeck.jaaslogin=$JAAS_LOGIN \
           -Djava.security.auth.login.config=$JAAS_CONF \
           -Dloginmodule.name=$LOGIN_MODULE \
           -Drdeck.config=$RDECK_CONFIG \
           -Drundeck.server.configDir=$RDECK_SERVER_CONFIG \
           -Dserver.datastore.path=$RDECK_SERVER_DATA/rundeck \
           -Drundeck.server.serverDir=$RDECK_INSTALL \
           -Drdeck.projects=$RDECK_PROJECTS \
           -Drdeck.runlogs=$RUNDECK_LOGDIR \
           -Drundeck.config.location=$RDECK_CONFIG_FILE \
           -Djava.io.tmpdir=$RUNDECK_TEMPDIR \
           -Drundeck.server.workDir=$RUNDECK_WORKDIR \
           -Dserver.http.port=$RDECK_HTTP_PORT \
           -Drdeck.base=$RDECK_BASE"
#
################# AFTER #####################################
RDECK_JVM="-Drundeck.jaaslogin=$JAAS_LOGIN \
           -Djava.security.krb5.realm=YOUR_DOMAIN \
           -Djava.security.krb5.kdc=YOUR_DOMAIN_CONTROLLER_IP \
           -Djava.security.auth.login.config=$JAAS_CONF \
           -Dloginmodule.name=$LOGIN_MODULE \
           -Drdeck.config=$RDECK_CONFIG \
           -Drundeck.server.configDir=$RDECK_SERVER_CONFIG \
           -Dserver.datastore.path=$RDECK_SERVER_DATA/rundeck \
           -Drundeck.server.serverDir=$RDECK_INSTALL \
           -Drdeck.projects=$RDECK_PROJECTS \
           -Drdeck.runlogs=$RUNDECK_LOGDIR \
           -Drundeck.config.location=$RDECK_CONFIG_FILE \
           -Djava.io.tmpdir=$RUNDECK_TEMPDIR \
           -Drundeck.server.workDir=$RUNDECK_WORKDIR \
           -Dserver.http.port=$RDECK_HTTP_PORT \
           -Drdeck.base=$RDECK_BASE"
#

Step 4./ Create a Key Storage

Rundeck’s Key Storage is a set of functionality that allows you to securely store private keys, public keys, passwords, and other secrets for use in your Rundeck jobs. We need to configure the Key Storage of our project. This option is a way to save the password of the authentication user of our remote machine, without having to pass the password directly in the resources.xml file

– Click on the upper right setting in Rundeck Server and go to Key Storage

In Key Type select Password option, in Enter Text set the password of the your domain user account, Storage path is optional, you can set a folder name for password storage, and the Name is the name of the file in which to store the desired password. Enter all the details and click the save button.

Step 5./ Add a Windows Node to your Project

– Open the resources.xml file present at your project folder and add below entry to add the windows remote host node to resource list.

  <node name="ylcwsrv02" description="A File Server node." tags="File Server" 
    hostname="192.168.1.11" username="winrmuser" 
    osFamily="Windows" osName="Microsoft Windows Server 2012 R2 Standard" osArch="amd64"
    node-executor="overthere-winrm" winrm-auth-type="kerberos" winrm-protocol="http"
    winrm-cmd="CMD" winrm-kerberos-debug="true"
    winrm-domain="YALLALABS.LOCAL" winrm-password-storage-path="keys/winrmuser.password">
  </node>

name: Specify the node name of the remote server
hostname: Remote host node, can be the ip address and include port number the default port are 5985/5986 (http/https).
username: Remote username to get access to the remote host
winrm-cmd: Execute commands using Cmd or PowerShell
winrm-password-storage-path: Specifies a Key Storage Path to look up the authentication password from
winrm-protocol: Determine the protocol to use, can be http or https
winrm-auth-type: Type of authentication to use, can be basic or kerberos
winrm-domain: Kerberos domain

Step 6./ Execute Test commands

To test the functionality we are going to run a simple command ” ipconfig ” on the remote host

 
We hope this tutorial was enough Helpful. If you need more information, or have any questions, just comment below and we will be glad to assist you!