ChefDK - WinRM switching to basic auth when Domain credentials are provided. - ruby

Question

I'm using ChefDK 0.3.5 on Windows 7 64bit. I'm having a bit of a problem trying to use Chef and WinRM to execute the
chef-client command on a remote server. The command I'm issuing is below:
C:\U\user1> knife winrm "fqdn:testserver.*" "netstat" -x 'domain\user1' -P 'password'
WARNING: Switching to Negotiate authentication, Basic does not support Domain Authentication
ERROR: RuntimeError: Error: Unencrypted communication not supported. Please check winrm configuration winrm/config/service AllowUnencrypted flag.
The result I got doesn't let me do what I want. So I googled it, and saw
something about not verifying SSL, or using :verify_peer, which did nothing
as well. So I executed the WinRM configuration commands again, in Command
Prompt, because PowerShell tells me their wrong.
C:\Users\user1>C:\WIndows\System32\cmd.exe /c winrm set winrm/config/winrs #{MaxMemoryPerShellMB="300"}
Winrs
AllowRemoteShellAccess = true
IdleTimeout = 7200000
MaxConcurrentUsers = 10
MaxShellRunTime = 2147483647
MaxProcessesPerShell = 25
MaxMemoryPerShellMB = 300
MaxShellsPerUser = 30
C:\Users\user1>C:\WIndows\System32\cmd.exe /c winrm set winrm/config #{MaxTimeoutms="1800000"}
Config
MaxEnvelopeSizekb = 500
MaxTimeoutms = 1800000
MaxBatchItems = 32000
MaxProviderRequests = 4294967295
Client
NetworkDelayms = 5000
URLPrefix = wsman
AllowUnencrypted = false
Auth
Basic = true
Digest = true
Kerberos = true
Negotiate = true
Certificate = true
CredSSP = false
DefaultPorts
HTTP = 5985
HTTPS = 5986
TrustedHosts
Service
RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;G
XGW;;;WD)
MaxConcurrentOperations = 4294967295
MaxConcurrentOperationsPerUser = 1500
EnumerationTimeoutms = 240000
MaxConnections = 300
MaxPacketRetrievalTimeSeconds = 120
AllowUnencrypted = true
Auth
Basic = false
Kerberos = true
Negotiate = true
Certificate = false
CredSSP = false
CbtHardeningLevel = Relaxed
DefaultPorts
HTTP = 5985
HTTPS = 5986
IPv4Filter = *
IPv6Filter = *
EnableCompatibilityHttpListener = false
EnableCompatibilityHttpsListener = false
CertificateThumbprint
AllowRemoteAccess = true
Winrs
AllowRemoteShellAccess = true
IdleTimeout = 7200000
MaxConcurrentUsers = 10
MaxShellRunTime = 2147483647
MaxProcessesPerShell = 25
MaxMemoryPerShellMB = 300
MaxShellsPerUser = 30
C:\Users\user1>C:\WIndows\System32\cmd.exe /c winrm set winrm/config/service#{AllowUnencrypted="true"}
Service
RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;
;;WD)
MaxConcurrentOperations = 4294967295
MaxConcurrentOperationsPerUser = 1500
EnumerationTimeoutms = 240000
MaxConnections = 300
MaxPacketRetrievalTimeSeconds = 120
AllowUnencrypted = true
Auth
Basic = false
Kerberos = true
Negotiate = true
Certificate = false
CredSSP = false
CbtHardeningLevel = Relaxed
DefaultPorts
HTTP = 5985
HTTPS = 5986
IPv4Filter = *
IPv6Filter = *
EnableCompatibilityHttpListener = false
EnableCompatibilityHttpsListener = false
CertificateThumbprint
AllowRemoteAccess = true
After executing these commands, I try again, and ChefDK looks at me like I'm
stupid. I'm not sure why Chef is trying to use basic auth then I give it
domain credentials. This also worked previously, but I had to get a new
computer and my notes, and installations were lost. Are there any ideas on
what I could be missing? If I'm missing any information let me know and I'll update my question.

Answer 1

The client command tells you:
Unencrypted communication not supported. Please check winrm configuration winrm/config/service AllowUnencrypted flag.
Your configuration, as printed out from the result of the timeout command, tells you:
Config
MaxEnvelopeSizekb = 500
MaxTimeoutms = 1800000
MaxBatchItems = 32000
MaxProviderRequests = 4294967295
Client
NetworkDelayms = 5000
URLPrefix = wsman
AllowUnencrypted = false
You need to set the AllowUnencrypted flag to true, by running the command:
winrm set winrm/config/service #{AllowUnencrypted="true"}
The latest github versions of knife-windows add commands for creating ssl certs and tightening up your connection, which you will hopefully want to do when you're ready.