Appendix: WinRM and SSH setup · 20.4
Typical errors
| Message or symptom | Cause | Solution |
|---|---|---|
| WinRM cannot complete the operation or timeout | Port 5985/5986 blocked, WinRM not enabled, or wrong host name. | Check Test-WSMan, the firewall and Enable-PSRemoting. |
| Access is denied | Account is not a local administrator, or remote UAC filters a local account. | Add the account to Administrators; for local accounts see LocalAccountTokenFilterPolicy. |
| The WinRM client cannot process the request … TrustedHosts | Target outside the domain is not in TrustedHosts, or an IP address is used. | Add the name to TrustedHosts or use the HTTPS listener. |
| The SSL certificate … is not trusted or name mismatch | Listener certificate not trusted or issued for a different name. TLSPilot then uses WinRM over HTTP (5985) and shows the reason. | Trust the issuer on the management host and use the name in the certificate. |
| Kerberos error with a short host name, or credential invalid on . (Exchange) | Short name or IP address instead of the FQDN. | Enter the FQDN of the target. |
| Permission denied (publickey) | Public key missing, wrong permissions on .ssh, or wrong user. | Check authorized_keys and the permissions 700/600. |
| sudo: a password is required or sudo needs a password. Open the target, use Helper, Show script, and run that script once as root on <host> | Wrapper or command not allowed in sudoers.d, or the helper script has not run on this host. | Open the deployment, tab Helper, Show script…, run the script once as root on the host and check with visudo -c. It installs the least-privilege wrapper for this deployment. |
| Health Unknown: Certificate file <path> is not readable by the SSH user (check mode and owner). | The Health check reads the file with the same rights as the configuration check: through the wrapper, otherwise sudo -n, otherwise as the SSH user. None of them may read the file. | Run the helper script of the deployment, or adjust mode and owner of the file. |
| Health Unknown: Tomcat keystore password is missing for <path> or is wrong for <path> | The keystore password in the deployment is empty or does not match, and there is no password file <keystore>.pwd next to the keystore. | Enter the keystore password of the deployment and deploy again. |
| Health Unknown: Keystore format is not supported: <path> | The file is neither PKCS #12 nor JKS. | Deploy the certificate again so that TLSPilot writes the keystore. |
| The wrapper … is not installed or not allowed for <user> | The toggle Least-privilege wrapper is installed is on, but the wrapper of this deployment is missing. | Run the helper script of the deployment once as root. |
| Paths changed. Run the helper script again. | Certificate paths of the deployment differ from those in the installed wrapper. | Run the helper script of the deployment again as root on the host. |