0

我正在尝试使用证书将凭据嵌入到服务资源中。我在基础设施中安装了 PKI，并且我的所有测试服务器都是自动注册的。我在本地导出了他们的证书以使用并将它们放在我的 ConfigData 中，如下所示：

@{
    AllNodes = @(

    @{
        NodeName = "*"
        NeoConfigDestinationPath = "D:\ServerBox\Servers\JRun4\_build\shared\config"
    }

    @{
        NodeName = 'DEVOPS'
        Role = @('DSCPullServer')
        CertificateFile = "D:\EQ_DSCModule\Certs\DEVOPS.cer"
        Thumbprint = "AE4F10AE4141C8726EEEBE888C69FE7ABB3099A8"
    }

    @{
        NodeName = 'Server1'
        Role = @('IIS', 'ServerBox', 'DevInt')
        CFServices = @("Adobe CF9 1", "Adobe CF9 2", "Adobe CF9 3", "Adobe CF9 4")
        CertificateFile = "D:\EQ_DSCModule\Certs\Client1.cer"
        Thumbprint = "4FA343A76AEA2B805850190E9C04AA9E2A82A162"
    }

    @{
        NodeName = 'Server2'
        Role = @('IIS', 'ServerBox', 'DevInt')
        CFServices = @("Adobe CF9 1")
        CertificateFile = "D:\EQ_DSCModule\Certs\Client2.cer"
        Thumbprint = "0FCB76684F0C74495DEB54F637B50BDA7182483D"
    }

    )

    ServerBoxConfig = @{
        SourcePath = "\\Share\Path\DevOps\ServerBox"
        DestinationPath = "D:\ServerBox"
    }

    DevIntConfig = @{
        SourcePath = "\\Share\Path\DevOps\DevInt"
        DestinationPath = "D:\ServerBox\IIS\wwwroot"
        NeoConfigSourcePath = "\\Share\Path\DevOps\ServerConfig\Environments\DevInt\NeoConfig"
    }
}

这是我正在运行的配置脚本：

$webCFDevCred = Get-Credential -Credential "svc-webcfdev@domain.com"

Configuration EqConfig
{

    Import-DSCResource -Module xPSDesiredStateConfiguration
    Import-DSCResource -Module cChoco

    Node $AllNodes.NodeName {

        cChocoInstaller installChoco {
            InstallDir = "C:\ProgramData\Chocolatey"
        }

    }

    Node $AllNodes.Where({ $_.role -eq 'DSCPullServer' }).NodeName { ... } #DSCPullServer

    Node $AllNodes.Where({ $_.role -eq 'IIS' }).NodeName { ... } #IIS

    Node $AllNodes.Where({ $_.role -eq 'ServerBox' }).NodeName {

        File ServerBox
        {
            Ensure = "Present"
            Type = "Directory"
            Recurse = $true
            MatchSource = $true
            Force = $true
            Checksum = "modifiedDate"
            SourcePath = $ConfigurationData.ServerBoxConfig.SourcePath
            DestinationPath = $ConfigurationData.ServerBoxConfig.DestinationPath
        }

    } #ServerBox

    Node $AllNodes.Where({ $_.role -eq 'DevInt' }).NodeName {

        File DevInt
        {
            Ensure = "Present"
            Type = "Directory"
            Recurse = $true
            MatchSource = $true
            Force = $true
            Checksum = "modifiedDate"
            SourcePath = $ConfigurationData.DevIntConfig.SourcePath
            DestinationPath = $ConfigurationData.DevIntConfig.DestinationPath
            DependsOn = "[File]ServerBox"
        }

        File DevInt_Config
        {
            Ensure = "Present"
            Type = "Directory"
            MatchSource = $true
            Force = $true
            Checksum = "modifiedDate"
            SourcePath = $ConfigurationData.DevIntConfig.NeoConfigSourcePath
            DestinationPath = $Node.NeoConfigDestinationPath
            DependsOn = "[File]ServerBox"
        }

        #This runs a script to build out the ColdFusion cluster/servers
        #Uses the number of services as the param for serverCount
        cChocoPackageInstaller installServerBox {
            Name = "ServerBox.DevInt -params $($Node.CFServices.Length)"
            DependsOn = @("[cChocoInstaller]installChoco", "[File]DevInt_Config")
        }

        #Sets the services generated by the ServerBox script
        $Node.CFServices.ForEach({
            Service "Service-$_" {
                Name = $_
                State = 'Running'
                Credential = $webCFDevCred
                DependsOn = "[cChocoPackageInstaller]installServerBox"
            }
        })

    } #DevInt

} #Configuration

EqConfig -ConfigurationData .\EQConfigData.psd1 -Output .\EqConfig -Verbose

Function Get-ComputerGuid
{
    param (
        [Parameter(Mandatory = $true)]
        [string]$ComputerName
    )
    process
    {
        ([guid]([adsisearcher]"(samaccountname=$ComputerName`$)").FindOne().Properties["objectguid"][0]).Guid
    }
}

$DSCPullFolder = "C:\Program Files\WindowsPowerShell\DscService\Configuration"

Get-ChildItem .\EqConfig\* -Filter *.mof | ForEach-Object {
    $guidMofFile = "$DSCPullFolder\$(Get-ComputerGuid $_.BaseName).mof"
    $newMof = copy $_.FullName $guidMofFile -PassThru -Force
    $newHash = (Get-FileHash $newMof).hash
    [System.IO.File]::WriteAllText("$newMof.checksum", $newHash)
}

Configuration EqLocalConfig
{
    Node $AllNodes.NodeName {
        LocalConfigurationManager {
            AllowModuleOverwrite = 'True'
            CertificateID = $Node.Thumbprint
            ConfigurationID = $(Get-ComputerGuid $nodeName)
            ConfigurationModeFrequencyMins = 15
            ConfigurationMode = 'ApplyAndAutoCorrect'
            RebootNodeIfNeeded = 'True'
            RefreshMode = 'PULL'
            DownloadManagerName = 'WebDownloadManager'
            DownloadManagerCustomData = (@{ ServerUrl = "https://DEVOPS:443/psdscpullserver.svc" })
        }
    }
}

EqLocalConfig -ConfigurationData .\EQConfigData.psd1 -Verbose

Set-DscLocalConfigurationManager -Path .\EqLocalConfig -Verbose

据我所知，它应该可以工作。我的 MOF 是在内部使用加密密码生成的，但是当客户端服务器获取配置并进入服务步骤时，它会出错。检查事件查看器，这是事件的详细信息：

"此事件表示 LCM 处理配置时发生故障。ErrorId 为 0x1。ErrorDetail 为 SendConfigurationApply 函数未成功。ResourceId 为 [Service]Service-Adobe CF9 1，SourceInfo 为 D:\EQ_DSCModule\EqConfig.ps1： :285::4::Service。ErrorMessage 是 PowerShell 提供程序 MSFT_ServiceResource 无法执行 Set-TargetResource 功能，并显示错误消息：无法更改“凭据”属性。消息：“Win32_Service”的“更改”方法失败，错误代码： '22'。。”

根据 MSDN ( https://msdn.microsoft.com/en-us/library/aa384901%28v=vs.85%29.aspx ) Change 方法上的错误代码 22 表示“运行此服务的帐户是无效或缺乏运行服务的权限。” 我知道服务帐户工作正常，我可以使用 WMI 自己添加它，如下所示：

For ($i=0; $i -lt $clusterCount; $i++) {
    (Get-WmiObject -Query "SELECT * FROM Win32_Service WHERE Name = 'Adobe CF9 $($i+1)'").Change($null,$null,$null,$null,$null,$null,'svc-webcfdev@domain.com','password',$null,$null,$null)
}

因此，如果我可以使用 WMI 添加帐户，那么 DSC 应该也可以，对吧？啊!

想法？

4

1 回答 1

1

当您同时使用证书文件和指纹 (certificateid) 时，将使用证书文件进行加密，但只有您输入的指纹 (certificateid) 才会写入 .mof 文件。他们很容易失去同步。作为测试尝试将证书添加到本地机器存储，然后从脚本中删除对证书文件的引用。如果找不到证书，请重新生成并修复任何问题。看看是否能解决问题。

于 2015-03-30T21:25:25.740 回答