states.cmd command "run" does not accept password parameter

[Akvalangs]

Description of Issue/Question

Executing powershell command using state "cmd" does not accept parameter "password". Error message: "password is a required argument for runas on Windows".

Setup

Blablabla:
  cmd.run:
    - name: Clear-Host
    - shell: powershell
    - runas: [domain]\[user]
    - password: [password]

Steps to Reproduce Issue

Excute state on Windows Server (standalone minion) by command: C:\salt>salt-call.bat --local state.apply

Versions Report

Salt Version:
           Salt: 2016.3.0

Dependency Versions:
           cffi: 1.6.0
       cherrypy: 5.3.0
       dateutil: 2.5.3
          gitdb: 0.6.4
      gitpython: 2.0.2
          ioflo: 1.5.3
         Jinja2: 2.8
        libgit2: Not Installed
        libnacl: 1.4.5
       M2Crypto: Not Installed
           Mako: 1.0.4
   msgpack-pure: Not Installed
 msgpack-python: 0.4.7
   mysql-python: Not Installed
      pycparser: 2.14
       pycrypto: 2.6.1
         pygit2: Not Installed
         Python: 2.7.11 (v2.7.11:6d1b6a68f775, Dec  5 2015, 20:40:30) [MSC v.1500 64 bit (AMD64)]
   python-gnupg: 0.3.8
         PyYAML: 3.11
          PyZMQ: 15.2.0
           RAET: Not Installed
          smmap: 0.9.0
        timelib: 0.2.4
        Tornado: 4.3
            ZMQ: 4.1.2

System Versions:
           dist:
        machine: AMD64
        release: 2008ServerR2
         system: Windows
        version: 2008ServerR2 6.1.7601 SP1 Multiprocessor Free

[Ch3LL]

@Akvalangs looks like this is a duplicate of #33676 and it also looks like it has been fixed and is included in 2016.3.1. Can you upgrade to 2016.3.1 and give that a try and report back whether you are still seeing the behavior? Thanks!

[ghost]

I'm having the same problem with cmd.run. I've tried it both as a custom module that calls cmd.run and using the cmd.run state.

Error message:

    Function: cmd.run
      Result: False
     Comment: password is a required argument for runas on Windows
     Started: 03:14:31.279000
    Duration: 0.0 ms
     Changes:

product.sls:

AddLink:
  module.run:
    - name: cmd.run
    - cmd: 'cp //server10/c$/www/AddLinkData/AddLinkCleaner.exe C:/www/AddLinkData/'
    - runas: 'WEB\\
    - password: '{{ salt['pillar.get']('blah:blah') }}'


'cp //server10/c$/www/AddLinkData/AddLinkCleaner.exe C:/www/AddLinkData/':
  cmd.run:
    - runas: 'WEB\\phoebe'
    - kwargs: {
      password: '{{ salt['pillar.get']('passwords:phoebe') }}'
    }

Reproduce issue:

Execute state on windows minion: salt 'winServer' state.apply product

Version

Salt Version:
           Salt: 2016.3.1

Dependency Versions:
           cffi: Not Installed
       cherrypy: Not Installed
       dateutil: 2.4.2
          gitdb: 0.6.4
      gitpython: 1.0.1
          ioflo: Not Installed
         Jinja2: 2.8
        libgit2: Not Installed
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: 1.0.3
   msgpack-pure: Not Installed
 msgpack-python: 0.4.6
   mysql-python: Not Installed
      pycparser: Not Installed
       pycrypto: 2.6.1
         pygit2: Not Installed
         Python: 2.7.11+ (default, Apr 17 2016, 14:00:29)
   python-gnupg: Not Installed
         PyYAML: 3.11
          PyZMQ: 15.2.0
           RAET: Not Installed
          smmap: 0.9.0
        timelib: Not Installed
        Tornado: 4.2.1
            ZMQ: 4.1.4

System Versions:
           dist: Ubuntu 16.04 xenial
        machine: x86_64
        release: 4.4.0-21-generic
         system: Linux
        version: Ubuntu 16.04 xenial

[orner]

I'm running 2016.3.1, and I'm having this same problem, which seems like it's making the runas functionality on Windows nonusable.

Function: module.run
    Name: cmd.run
  Result: False
 Comment: Module function cmd.run threw an exception. Exception: password is a required argument for runas on Windows
 Started: 09:50:52.453000
Duration: 16.0 ms
 Changes:


TestCmd:
  module.run:
    - name: cmd.run
    - cmd: 'ping 10.222.132.168'
    - runas: 'Administrator'
    - password: 'xxxxx'

$ salt 'windows-ad' state.sls sls/common/lmo_test

[cachedout]

I don't have a Windows box in front of me but we've merged some fixes that could be related:

#35952
#34292

cc: @twangboy and @UtahDave

[twangboy]

@cachedout The problem is that the module.run state is not forwarding the password parameter to the cmd.run function.

What I think is going on:
It looks like it tries to match up the named parameters expected by the target function. But, password is accepted as a *kwarg, so it's not specifically identified in the target function.... so it's getting dropped?

[twangboy]

@Akvalangs @Ch3LL I'm unable to replicate this. I'm running salt 2016.3.4.

This could be an issue running salt as a service versus running salt in an elevated command prompt. Currently runas functionality in Windows will only work if the salt-minion is running as a service under the Local System account.

[twangboy]

@Akvalangs @Ch3LL Can you verify that this is failing when running salt-minion as a service under the Local System account?

[cachedout]

Closed for lack of reply.

[droptables]

Hey all, ran into this today. It shows conflicting output. It wants the 'password' when running as a user but then says password is invalid keyword. Ideas?

----------
          ID: install_clint
    Function: pip.installed
        Name: clint
      Result: False
     Comment: Error installing 'clint': password is a required argument for runas on Windows
     Started: 21:27:20.653000
    Duration: 342.0 ms
     Changes:
    Warnings: 'password' is an invalid keyword argument for 'pip.installed'. If
              you were trying to pass additional data to be used in a template
              context, please populate 'context' with 'key: value' pairs. Your
              approach will work until Salt Oxygen is out. Please update your
              state files.

SLS File:

install_clint:
  pip.installed:
    - user: Administrator
    - password: 'PASSWORD'
    - name: clint
    - cwd: 'C:\Python27\Scripts'
    - bin_env: 'C:\Python27\Scripts\pip.exe'
    - upgrade: False

Master:

Installed Packages
Name        : salt-master
Arch        : noarch
Version     : 2016.11.4
Release     : 1.el7
Size        : 1.6 M
Repo        : installed
From repo   : salt-latest
Summary     : Management component for salt, a parallel remote execution system
URL         : http://saltstack.org/
License     : ASL 2.0
Description : The Salt master is the central server to which all minions connect.

Minion-Windows:

salt-minion 2016.11.4 (Carbon)

[twangboy]

I don't think the pip.installed state was setup to handle runas on Windows. We would probably need to go through all states/modules that use cmd.run and add the ability to pass a password on Windows.

[konstest]

Steps to Reproduce Issue

root@salt-master:/srv/salt# cat test.sls 
git lfs install --skip-smudge:
  cmd.run:
    - runas: domain\user
    - password: user_pass

root@salt-master:/srv/salt# salt minion_name state.apply test
minion_name:
ERROR: password is a required argument for runas on Windows

Versions Report

Salt Version:
Salt: 2017.7.1

Dependency Versions:
cffi: 1.5.2
cherrypy: unknown
dateutil: 2.4.2
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
ioflo: Not Installed
Jinja2: 2.8
libgit2: 0.24.0
libnacl: Not Installed
M2Crypto: Not Installed
Mako: Not Installed
msgpack-pure: Not Installed
msgpack-python: 0.4.6
mysql-python: Not Installed
pycparser: 2.14
pycrypto: 2.6.1
pycryptodome: Not Installed
pygit2: 0.24.0
Python: 2.7.12 (default, Nov 19 2016, 06:48:10)
python-gnupg: Not Installed
PyYAML: 3.11
PyZMQ: 15.2.0
RAET: Not Installed
smmap: Not Installed
timelib: Not Installed
Tornado: 4.2.1
ZMQ: 4.1.4

System Versions:
dist: Ubuntu 16.04 xenial
locale: ANSI_X3.4-1968
machine: x86_64
release: 4.4.0-96-generic
system: Linux
version: Ubuntu 16.04 xenial

salt-minion 2017.7.1 (Nitrogen)

[nicholasaleks]

Problem persists in salt 2018.3.0 (Oxygen)

[twangboy]

This issue was fixed in 2017.7.2. It is also fixed on the head of 2018.3, which will become 2018.3.1.