Provide an installer

[magnetik]

Hi,

In order to be able to ease the use in a work environnement, providing an installer that can install a windows service directly would be really useful.

Ton of thanks for Px :)

[genotrance]

Thank you for the feedback - this one is a bit challenging, even if keeping aside the headaches of Windows services in general.

Px can only run once you are logged in since it authenticates as the logged in user. If you want it to run as a service (which typically start before login), it means you need to setup the service with the user's credentials and that's a manual process. And it defeats the purpose of Px which is to not require any credential setup (and maintenance), unlike cNTLM and the like.

What we could build is a simple installer that creates a Px shortcut into the Windows Startup folder and also collect and setup px.ini during install instead of requiring manual copying and editing.

I'm curious what your thoughts are on such an installer and whether it will meet the needs of most users of Px.

[magnetik]

Hey, thanks for your answer.

I'm not really a windows pro, but I had in mind that there was some options to start a service as a specific user.
Indeed I would not use it if it requires to specify credentials.

A simple installer with an option to add a shortcut in the windows startup folder would be something I use as it makes setuping new machines easier.
Not sure if it worth the trouble of making an installer... I know nothing about it.

[genotrance]

Px can now add/remove an entry into the Windows registry to start on install. Please see if it meets your needs.

px --install
px --uninstall

You will need to have all settings specified in px.ini in order for this to work since no command line flags are saved in the registry. I'm currently working on the ability to --save all settings on the command line so you can create a px.ini with all custom settings without having to manually edit the file. E.g.

px --proxy=proxyserver:80 --port=3129 --noproxy=10...* --save
px --install

[genotrance]

Just posted v0.3.0 so marking this as closed.

[aateeque]

What about installing with nssm? Will that work?
I ask, because I am setting up px on a server where there's no login. A service account authenticated with AD will be used for "logon as" so I wonder if that will work?

[genotrance]

I think this should be possible but I didn't go that far considering Px uses the credentials of the logged in user to authenticate with the proxy server. The fact that the user has already provided his login/pass to the OS on logging in, they don't need to type it in again for Px. This means if their password changes, Px does not care since the user would have to login with the new password.

To run Px as a service, you have to store the service account password in Windows services and it's still hard coded and if the password changes, you need to change it there. I was thinking you might as well use cNTLM but then just realized that it requires it's own copy of the login/pass in its ini file to work.

It appears there might be value in enabling Px to run pre-login. You would just update the service account password in Windows services and not have to update another copy of the password.

I think this could be handled with just documentation but having a --install-service which abstracts everything would be nice.

[aateeque]

Agreeed- if we can encapsulate it into --install-service it would be pretty neat.

I have tried running px as a windows service via nssm; it just crashes at present:

px: Unexpected status SERVICE_STOPPED in response to START control.

[genotrance]

I just tried via nssm and it worked nicely. Here's the steps I used:-

• Download and save nssm to a good directory
• Download and setup Px per usual
• Start an admin console and run the following

nssm install Px c:\path\to\px.exe
nssm set Px ObjectName domain\username password
nssm start Px

Note I set this up and tested Px from the same system so I was logged in already. Let me know what you find.

Given installing a service requires admin access and the actual user/pass, I'd rather document this in the README than to add it as a command.

[aateeque]

So I deleted the first nssm services and reinstalled it; now I can see the service starting but I have the following in debug-MainProcess.log:

Traceback (most recent call last):
  File "px.py", line 1036, in <module>
  File "px.py", line 784, in parsecli
  File "px.py", line 996, in attachConsole
  File "site-packages\psutil\__init__.py", line 721, in cmdline
  File "site-packages\psutil\_pswindows.py", line 639, in wrapper
psutil.AccessDenied: psutil.AccessDenied (pid=636)

Any connections are refused with:

fatal: unable to access 'https://github.com/praeclarum/FuGetGallery.git/': Failed to connect to 127.
0.0.1 port 3128: Connection refused

[genotrance]

It appears you are running px.py rather than the binary and an older version since line 996 is no longer related to attachConsole(). Can you update to the latest? There were some fixes related to psutil.AccessDenied.

[aateeque]

Okay i'll give that a go, and will open new issue if I see any; thanks!