Runas any user even when shell is limited like winrm #47621

dwoz · 2018-05-12T08:01:13Z

What does this PR do?

Fix runas when running under winrm.
Support for LOCAL SERVICE and NETWORK SERVICE system accounts.
Runas can now use system accounts from salt-call.
(SYSTEM, LOCAL SERVICE and NETWORK SERVICE)
Runas can launch processes on behalf of users without a password.

What issues does this PR fix or reference?

Some tests fail when run over winrm because of restrictions.

Tests written?

No

Commits signed with GPG?

Yes

damon-atkins · 2018-05-15T10:53:27Z

Seems like a good idea. Please use a class for constants like in modules/reg.py

dwoz · 2018-05-23T23:33:24Z

This should fix

#47621

twangboy · 2018-05-23T23:50:39Z

salt/utils/win_runas.py

    stdin_read, stdin_write = win32pipe.CreatePipe(security_attributes, 0)
-    stdin_read = make_inheritable(stdin_read)
+    stdin_read = salt.utils.winutil.make_inheritable(stdin_read)


twangboy · 2018-05-23T23:50:46Z

salt/utils/win_runas.py


    stdout_read, stdout_write = win32pipe.CreatePipe(security_attributes, 0)
-    stdout_write = make_inheritable(stdout_write)
+    stdout_write = salt.utils.winutil.make_inheritable(stdout_write)


twangboy · 2018-05-23T23:50:57Z

salt/utils/win_runas.py

-    fd_err = msvcrt.open_osfhandle(stderr_read, os.O_RDONLY | os.O_TEXT)
-    with os.fdopen(fd_err, 'r') as f_err:
-        ret['stderr'] = f_err.read()
+    stderr_write = salt.utils.winutil.make_inheritable(stderr_write)


twangboy · 2018-05-23T23:51:08Z

salt/utils/win_runas.py

+
+    salt.utils.winutil.kernel32.CloseHandle(stdin_write.handle)
+    salt.utils.winutil.kernel32.CloseHandle(stdout_write.handle)
+    salt.utils.winutil.kernel32.CloseHandle(stderr_write.handle)


twangboy · 2018-05-23T23:51:48Z

salt/utils/win_runas.py

+
+def runas(cmdLine, username, password=None, cwd=None, elevated=True):
+
+    impersonation_token = salt.utils.winutil.impersonate_sid(


Shouldn't this be salt.winutil now?

twangboy · 2018-05-23T23:53:12Z

salt/utils/win_runas.py

+        salt.utils.winutil.elevate_token(user_token)
+
+    handle_reg = win32profile.LoadUserProfile(user_token, {'UserName': username})
+    salt.utils.winutil.grant_winsta_and_desktop(user_token)


twangboy · 2018-05-23T23:53:33Z

salt/utils/win_runas.py

+        win32process.CREATE_SUSPENDED
+    )
+
+    startup_info = salt.utils.winutil.STARTUPINFO(


You get the idea...

twangboy · 2018-05-23T23:53:48Z

salt/utils/win_runas.py

+
+    env = win32profile.CreateEnvironmentBlock(user_token, False)
+
+    process_info = salt.utils.winutil.CreateProcessWithTokenW(


twangboy · 2018-05-23T23:54:55Z

salt/utils/win_runas.py

+#    salt.utils.winutil.kernel32.CloseHandle(user_token)
+    if impersonation_token:
+        win32security.RevertToSelf()
+#    salt.utils.winutil.kernel32.CloseHandle(impersonation_token)


Can we remove these comments?
And the salt.winutil thing

twangboy · 2018-05-23T23:55:17Z

salt/winutil.py

+except block because it is only applicable on Windows platforms.
+
+
+Much of what is here was adappted from the following:


damon-atkins · 2018-05-24T04:31:04Z

Some random thoughts.
Not sure module salt.win is the correct place. Maybe salt.utils.platform.win.somthing (if you break the file up). Maybe along the lines of how powershell is broken up e.g. salt.utils.platform.win.credentials class. Or even salt.platform.win.*
Get-<Name Of Python Class> e.g. Get-Credentials
Get-Module -ListAvailable | Format-Table Name, Description

There are also a few win_*.py in salt.utils

For example we have salt.utils.pkg.win

What I would like to see is a

salt.platform.file.posix
salt.platform.file.posix.linux
salt.platform.file.posix.solaris
salt.platform.cred.win
salt.platform.cred.posix
salt.platform.cred.posix.linux
salt.platform.cred.posix.solaris
salt.platform.cred.win
salt.platform.cred.aws

With a platform independent set of high level class methods where possible, with specific platform overrides.

dwoz · 2018-05-24T06:28:27Z

@damon-atkins, thanks so much for reviewing this. :)

salt.win came from discussions with @twangboy. The main driver for salt.win is to have a place for Windows specific stuff. For now salt.win only contains things related to logon. The plan is to expand on this module to make salt.win.logon, salt.win.service, salt.win.registry ect. I did not put the module under salt.utils to avoid having the loader try to import platform specifics automatically. I think anything under salt.utils gets touched by the loader automatically (I could be wrong on this). I'm down with salt.utils.platform provided the loader plays nicely. If not, maybe salt.platform works as a namespace for these things. Maybe @s0undt3ch or @cachedout have some opinions?

s0undt3ch · 2018-05-24T07:29:06Z

salt/utils/win_runas.py

+    username, domain = split_username(username)
+    sid, domain, sidType = win32security.LookupAccountName(domain, username)
+    if domain == 'NT AUTHORITY':
+        log.warn("Logon system account: %s", username)


Why warning?
Also, switch to log.warning, log.warn is deprecated in Py3.

I agree warning is overkill. Should these 'logon user' log statements go away completely?

If you think these will make sense when trying to debug an issue, leave then, but perhaps, at debug log level? Info?

Windows creates an event log for the logons so I've just removed these log statements.

s0undt3ch · 2018-05-24T07:32:59Z

salt/win.py

@@ -0,0 +1,1164 @@
+# -*- coding: utf-8 -*-
+'''
+Windows specific utility functions, this module should be imported in a try,


If this is a utilities module it should be moved to salt.utils.

I've read this and it looks good so far as I can tell, but I simply don't know enough about the Windows ecosystem to be able to review this in any real depth.

twangboy · 2018-07-19T19:55:36Z

I'm getting the following error on Py3 when I do a cmd.run running as a normal (non-admin) user. I haven't tried with an admin user. Here's the command I ran and the result on both Py2 and Py3.

root@master:/srv/salt/test# salt -t 300 dev* cmd.run whoami runas=testuser01 password=PassWord1!
dev(py2):
    win-8fgt3e045se\testuser01
dev3(py3):
    The minion function caused an exception: Traceback (most recent call last):
      File "c:\dev\salt\salt\minion.py", line 1619, in _thread_return
        return_data = minion_instance.executors[fname](opts, data, func, args, kwargs)
      File "c:\dev\salt\salt\executors\direct_call.py", line 12, in execute
        return func(*args, **kwargs)
      File "c:\dev\salt\salt\modules\cmdmod.py", line 1161, in run
        **kwargs)
      File "c:\dev\salt\salt\modules\cmdmod.py", line 411, in _run
        return win_runas(cmd, runas, password, cwd)
      File "c:\dev\salt\salt\utils\win_runas.py", line 62, in runas
        privs=['SeTcbPrivilege'],
      File "c:\dev\salt\salt\platform\win.py", line 1125, in impersonate_sid
        raise WindowsError("Impersonation failure")  # pylint: disable=undefined-variable
    OSError: Impersonation failure
root@shanelee-master:/srv/salt/test#

cachedout · 2018-08-03T15:33:07Z

doc/topics/releases/fluorine.rst

+
+A password is no longer required with ``runas`` under normal circumstances.
+The password option is only needed if the minion process is run under a
+restricted (non-administrator) account. 


As I recall, password is only needed if it's under a non-admin account AND it's requesting priv escalation, right? If so, I think that should be called out specifically.

@cachedout If the minion happens to be running under a non admin. They will need to use a password anytime the use the runas argument to cmd.run. Maybe this is better?

A password is no longer required with ``runas`` under normal circumstances. The password option is only needed if the minion process is run under a restricted (non-administrator) account. In the aforementioned case, a password is only required when using the ``runas`` argument to run command as a different user.

cachedout · 2018-08-03T15:36:56Z

tests/support/helpers.py

@@ -685,7 +685,7 @@ def wrap(cls):
                            username
                        )
                    )
-                    create_user = cls.run_function('user.add', [username])
+                    create_user = cls.run_function('user.add', [username], **kwargs)


Is the intention here just to pass groups? I'm wary of passing all kwargs unless that's truly needed.

@cachedout Yes, this is to pass groups. I'll change it to be more specific.

Actually, looking at this again. We are making the kwargs dictionary for the sole purpose of passing it to user.add. It is being used to pass timeout, groups, and password.

rallytime · 2018-08-03T19:02:38Z

@dwoz This has a merge conflict with the release notes. Can you fix that up?

- Fix runas when running under powershell remoting - Support for LOCAL SERVICE and NETWORK SERVICE system accounts. - Runas can now use system accounts from salt-call. (SYSTEM, LOCAL SERVICE and NETWORK SERVICE) - Runas can launch processes on behalf of users without a password. - Integration tests for win_runas module

dwoz · 2018-08-03T19:42:17Z

@rallytime fixed.

ghost self-requested a review May 12, 2018 08:01

dwoz force-pushed the win_runas branch 2 times, most recently from c112b6a to 34608cb Compare May 12, 2018 09:16

dwoz changed the title ~~WIP: Runas that works on limited shells for any user~~ WIP: Runas any user even when shell is limited (winrm) May 12, 2018

dwoz changed the title ~~WIP: Runas any user even when shell is limited (winrm)~~ WIP: Runas any user even when shell is limited like winrm May 12, 2018

dwoz requested a review from twangboy May 12, 2018 09:19

dwoz force-pushed the win_runas branch 7 times, most recently from da7506f to 92e93b7 Compare May 12, 2018 12:25

dwoz force-pushed the win_runas branch from 92e93b7 to 182c183 Compare May 23, 2018 21:51

dwoz changed the title ~~WIP: Runas any user even when shell is limited like winrm~~ Runas any user even when shell is limited like winrm May 23, 2018

dwoz force-pushed the win_runas branch from 182c183 to 6c1c17f Compare May 23, 2018 22:00

dwoz requested a review from s0undt3ch May 23, 2018 23:02

dwoz mentioned this pull request May 23, 2018

cmd.run on Windows does not default to the "runas" user's HOME directory nor obey the "cwd" parameter.. #47787

Closed

twangboy requested changes May 23, 2018

View reviewed changes

dwoz force-pushed the win_runas branch from 574f3b3 to e8b4536 Compare May 24, 2018 06:07

dwoz requested a review from cachedout May 24, 2018 06:28

dwoz requested a review from damon-atkins May 24, 2018 06:31

dwoz force-pushed the win_runas branch from e8b4536 to 4594439 Compare May 24, 2018 07:30

s0undt3ch suggested changes May 24, 2018

View reviewed changes

dwoz force-pushed the win_runas branch 2 times, most recently from 94c3a62 to 2a1da92 Compare May 24, 2018 16:34

damon-atkins approved these changes Jul 13, 2018

View reviewed changes

dwoz requested a review from UtahDave July 17, 2018 18:56

dwoz force-pushed the win_runas branch 2 times, most recently from 77ef5cb to 8626bef Compare August 1, 2018 22:18

rallytime requested a review from cachedout August 2, 2018 19:18

rallytime added the ZRELEASED - Fluorine reitred label label Aug 2, 2018

cachedout reviewed Aug 3, 2018

View reviewed changes

dwoz added 15 commits August 3, 2018 12:32

Pep8 and linter

da95d25

Fix spelling

e7bf068

Remove unwanted log statements

3aec4a2

Fix variable name

82523bc

Python 3 fixes

9e4c7c8

Move win module to platform namespace

502fd24

Fix psutil import

711ee97

Add __init__.py for platform module

406efbe

Elevate current token

5f1f9f0

Fix linter warnings

f0605cc

Fallback to un-priviledged runas

5a76557

Clean up and comment things for clarity

29a7afd

Document runas password changes

25e7b04

Update release notes with runas changes

b6fce06

dwoz force-pushed the win_runas branch from 2d882fd to b6fce06 Compare August 3, 2018 19:33

Fix doc change conflicts

09c1253

rallytime merged commit a9daa92 into saltstack:develop Aug 5, 2018

dwoz deleted the win_runas branch August 21, 2018 21:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Runas any user even when shell is limited like winrm #47621

Runas any user even when shell is limited like winrm #47621

dwoz commented May 12, 2018 •

edited

Loading

damon-atkins commented May 15, 2018 •

edited

Loading

dwoz commented May 23, 2018

twangboy May 23, 2018

twangboy May 23, 2018

twangboy May 23, 2018

twangboy May 23, 2018

twangboy May 23, 2018

twangboy May 23, 2018

twangboy May 23, 2018

twangboy May 23, 2018

twangboy May 23, 2018

twangboy May 23, 2018

damon-atkins commented May 24, 2018 •

edited

Loading

dwoz commented May 24, 2018 •

edited

Loading

s0undt3ch May 24, 2018

dwoz May 24, 2018

s0undt3ch May 24, 2018

dwoz May 24, 2018

s0undt3ch May 24, 2018

twangboy commented Jul 19, 2018 •

edited

Loading

cachedout Aug 3, 2018

dwoz Aug 3, 2018

cachedout Aug 3, 2018

dwoz Aug 3, 2018

dwoz Aug 3, 2018

rallytime commented Aug 3, 2018

dwoz commented Aug 3, 2018


		def runas(cmdLine, username, password=None, cwd=None, elevated=True):

		impersonation_token = salt.utils.winutil.impersonate_sid(


		env = win32profile.CreateEnvironmentBlock(user_token, False)

		process_info = salt.utils.winutil.CreateProcessWithTokenW(

		except block because it is only applicable on Windows platforms.


		Much of what is here was adappted from the following:

Runas any user even when shell is limited like winrm #47621

Runas any user even when shell is limited like winrm #47621

Conversation

dwoz commented May 12, 2018 • edited Loading

What does this PR do?

What issues does this PR fix or reference?

Tests written?

Commits signed with GPG?

damon-atkins commented May 15, 2018 • edited Loading

dwoz commented May 23, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

damon-atkins commented May 24, 2018 • edited Loading

dwoz commented May 24, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

twangboy commented Jul 19, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rallytime commented Aug 3, 2018

dwoz commented Aug 3, 2018

dwoz commented May 12, 2018 •

edited

Loading

damon-atkins commented May 15, 2018 •

edited

Loading

damon-atkins commented May 24, 2018 •

edited

Loading

dwoz commented May 24, 2018 •

edited

Loading

twangboy commented Jul 19, 2018 •

edited

Loading