[chef] Re: knife winrm via ssh gateway?

[Steven Murawski < >]

The knife-windows plugin allows you to bootstrap Windows nodes via WinRM or via SSH.  If you are using SSH as the transport, you can use an SSH gateway, but if you are using WinRM to bootstrap there is not such an option.  The same story exists for executing commands via WinRM through knife.

If you'd like to submit a pull request to add support for a WinRM gateway (which is possible, just not a common scenario in my experience), the project is https://github.com/opscode/knife-windows and is under active development.  One downside of a WinRM gateway is if you might have to inject a username and password into the remote session, possibly exposing that password in memory in that process.  If you have Kerberos delegation configured from the trusted gateway to the target node, that may be avoidable, but otherwise you might hit second-hop issues with the security context of the WinRM session.

Steve

-- 

Steven Murawski

Community Software Development Engineer @ Chef

Microsoft MVP - PowerShell
http://stevenmurawski.com

On January 9, 2015 at 10:30:56 AM, James Harrison ( "> ) wrote:

Hi there,

 

I am using the knife-windows plugin; it looks like I can bootstrap nodes through an ssh gateway, but I cannot execute a winrm command through an ssh gateway. Is that understanding correct? So the subcommand “knife winrm” has no ssh gateway option? I’m double checking because the rest of the knife-windows plugin seems to support ssh gateways.

 

If so, if the maintainers of the gem see this email can we work together so I can submit a patch that will allow this?

 

Thanks

 

James