The Agent Manager supports Basic and Negotiate WinRM authentication schemes with Windows credentials. The Negotiate authentication scheme is enabled by default in WinRM and is the recommended way to authenticate in most environments.
In order to establish connections over Windows® Remote Management (WinRM), you must provide a Windows credential. For more information, see Configuring credentials.
The Basic authentication scheme requires local Administrator accounts; you cannot use domain accounts. For more information, see Promoting remote users to administrators on local machines through the Domain Controller. Basic authentication is insecure because it transmits user names and passwords in an easily decoded string, and therefore it should not be used on an untrusted network. If Basic authentication is required, and security is a concern, configure the target system to accept only HTTPS traffic. For more information, see Manually configuring WinRM HTTPS access. If Basic authentication is not acceptable in your environment because of some specific security concerns, it can always be disabled.
You can also use Windows Group Policy Objects to automatically configure HTTP or HTTPS listeners in WinRM. For more information, see Using Group Policy Objects to configure WinRM.
Recent versions of Windows® OS include WinRM, but it is disabled by default. There are two ways to configure HTTP or HTTPS: manually or using Group Policy Objects.
The default WinRM settings allow only Negotiate authentication.
3 |
Optional. If Negotiate authentication is enabled, and you want to disable it, type the following: |
TIP: To enable or disable either Basic or Negotiate authentication, use the following command syntax:
winrm set winrm/config/service/auth @{<Basic|Negotiate>="<true|false>"} |
The certificate must be granted by a recognized certificate-granting authority (CA) in order for the Agent Manager to authenticate it. Otherwise you must install the root CA certificate in the Agent Manager’s trusted keystore, as described in Installing HTTPS certificates.
• |
host is a fully qualified host name, as it appears in the certificate. |
• |
thumbprint is the certificate thumbprint, with spaces removed. |
1 |
On the target machine, click Start. |
2 |
3 |
4 |
The Console Root window appears. |
5 |
6 |
In the Add or Remove Snap-ins dialog box that appears, in the Available snap-ins area, select Group Policy Object, and click Add. |
7 |
8 |
9 |
In the Console Root window, in the navigation tree on the left, choose Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Service. |
11 |
After you have edited the settings as necessary for your environment, close the Console Root window. |
2 |
Launch a command shell on the Agent Manager machine, and navigate to the <fglam_home>/bin directory. |
If the Agent Manager fails to find a configuration file, it attempts to automatically detect the required settings and writes them to $FGLAM/state/default/config/krb5.conf.
You can manually override the location of krb5.conf with the following command-line parameter:
-Djava.security.krb5.conf=</path/to/file>
WinRM connections using the default Negotiate authentication require a copy of the krb5.config file. On Windows®, the Agent Manager attempts to auto-generate this file and places it under <fglam_home>f/state/default/config/krb5.config. Under some circumstances, the Agent Manager is unable to auto-generate the file on Windows, in which case the file needs to be created. On UNIX® systems, the file is never auto-generated and must always be provided.
If the file needs to be created, the format of the krb5.config file for the WinRM Negotiate authentication is as follows:
The values dns_suffix_upper_case, dns_suffix_lower_case, and DNS_Server_for_dns_suffix_upper_case must be replaced with their actual values.
The [domain_realm] section in the file maps the domain of the host being connected to, to a realm.
The [realm] section provides the relevant kdc (key distribution center) server with a specific realm to use for kerberos authentication. This is generally the DNS server for the relevant domain.
The default_realm value in the libdefaults section is the realm mapping to use when the domain of the host cannot be matched to a realm.
For example, for connecting to hosts on the sample.domain.com domain with the dnsserver.sample.domain.com DNS Server, the contents of the krb5.config file should be as follows:
When connecting to a host1.sample.domain.com, the host1’s domain is mapped to the SAMPLE.DOMAIN.COM realm, which maps to the DNSSERVER.SAMPLE.DOMAIN.COM kdc to use for kerberos authentication.
After the krb5.config file is created the absolute path to the generated krb5.config file should be provided in the <config:krb5-config-file> tag value of the <fglam_home>/state/default/config/fglam-config.xml file, so that it can be accessed by the Agent Manager. Any changes to the fglam-config.xml file require the Agent Manager to be restarted in order for those changes to take effect. Therefore, if the Agent Manager is running while you are making these changes, you must restart it.
• |
By default, Windows does not allow JavaTM to access certain required session keys when JavaTM attempts to authenticate with Kerberos. The following registry keys should be added to ensure that the required sessions keys are available. The Agent Manager attempts to detect and update these registry keys automatically the first time a WinRM connection is attempted. |
• |
Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters |
• |
Value Name: allowtgtsessionkey |
• |
Value Type: REG_DWORD |
• |
Value: 0x01 |
• |
Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos |
• |
Value Name: allowtgtsessionkey |
• |
Value Type: REG_DWORD |
• |
Value: 0x01 |
The KerberosConfigurationService API provides the ability for agents to modify or create a Kerberos configuration file during runtime.
The Agent Manager uses the Kerberos configuration file to establish WinRM Negotiate connections to hosts. In most cases, the Agent Manager can create the Kerberos configuration for the current domain to which the machine running the Agent Manager belongs. However, the Kerberos configuration typically needs to be modified when cross-domain WinRM connections are required. This can be done by modifying the Kerberos configuration file manually, to add the new domain properties, and restarting the Agent Manager. If no instance of the previous Kerberos configuration file is found, the fglam.config.xml file needs to be updated to instruct the Agent Manger which Kerberos configuration file to use for WinRM connections.
All of these actions can also be performed during runtime, without requiring any manual changes, or an Agent Manager restart. The KerberosConfigurationService allows agents to make these changes during runtime and have the changes take effect immediately. If a new configuration file is created, fglam.config.xml file is updated automatically.
© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center