Re: CGI Problem on MS IIS 5.0 - Trying to access files on other machines

From: paulp (paulpigott_at_earthlink.net)
Date: 09/16/05

  • Next message: Steve Schofield: "Re: iis6 & asp.net 1.1: asp app cannot access folder" 
    Date: Thu, 15 Sep 2005 23:47:13 GMT

    Here is where my ignorance shows. What is a "double hop" issue?

    Paul

    "Pat [MSFT]" <patfilot@online.microsoft.com> wrote in message
    news:O2FMj9juFHA.1572@TK2MSFTNGP10.phx.gbl...
    > Set the site to be Basic Authentication and login as you. I suspect that
    > the .exe is either running as IWAM/IUSER (i.e. GUEST) or you are running
    > into a double hop issue.
    >
    >
    > Pat
    >
    > "paulp" <paulpigott@earthlink.net> wrote in message
    > news:RhlWe.12307$_84.12168@newsread1.news.atl.earthlink.net...
    > > Greetings,
    > >
    > > I'm working on a CGI program that will run under MS IIS 5.0 and will
    > > browse folders on three other machines, building HTML pages that will
    > > provide links to these folders.
    > >
    > > Essentially, the CGI will connect to each machine in turn, doing the
    > > FindFirst/FindNext process based on the current criteria. It will
    > > select certain files/folders, and build an HTML page as it goes.
    > >
    > > The premise is fine. If I run the program from the command line, it
    > > seems to work fine and I get my HTML code out. I can copy the code
    > > into a separate file, open it in the browser, and all appears right
    > > with the world.
    > >
    > > However, when I try to run the CGI from the browser itself, I get all
    > > kinds of problems. The first one I got was a 1312, "A specified logon
    > > session does not exist. It may have already been terminated." After
    > > doing some searching, I began to investigate impersonation of a logged
    > > on user. This produces a different error: 1314, "A required privilege
    > > is not held by the client."
    > >
    > > The code involved and the output I'm getting follows:
    > >
    > > ---------BEGIN----------
    > > class Impersonate:
    > > def __init__(self, login, password ):
    > > self.domain = '4Q9ND21'
    > > self.login = login
    > > self.password = password
    > > self.handel = None
    > > def logon(self):
    > > tracelist.append("Impersonate logon step 0")
    > > win32security.RevertToSelf() # terminates impersonation
    > > tracelist.append("Impersonate logon step 1")
    > > self.handel = win32security.LogonUser( self.login, self.domain,
    > > self.password, win32con.LOGON32_LOGON_INTERACTIVE,
    > > win32con.LOGON32_PROVIDER_DEFAULT )
    > > tracelist.append("Impersonate logon step 2")
    > > win32security.ImpersonateLoggedOnUser(self.handel)
    > > tracelist.append("Impersonate logon step complete")
    > > def logoff(self):
    > > win32security.RevertToSelf() # terminates impersonation
    > > if self.handel != None:
    > > self.handel.Close() # guarantee cleanup
    > > ----------END-----------
    > >
    > > and I execute this code with the following
    > >
    > > ---------BEGIN----------
    > > impersonate = Impersonate( 'PYTHONTEST', 'PYTHONTEST' )
    > > try:
    > > tracelist.append("about to attempt the IMPERSONATE")
    > > impersonate.logon()
    > > tracelist.append("impersonate did NOT throw exception")
    > > b=AdjustPrivilege(SE_SYSTEM_PROFILE_NAME)
    > > b=AdjustPrivilege(SE_TCB_NAME)
    > > try:
    > > tracelist.append("win32api.GetUserName = " +
    > > win32api.GetUserName() )
    > > # print win32api.GetUserName() #show you're someone else
    > > finally:
    > > impersonate.logoff() #return to normal
    > > except:
    > > a = "Impersonate Logon Error: %s %s" % (sys.exc_type,
    > > sys.exc_value)
    > > tracelist.append(a)
    > > # print sys.exc_type, sys.exc_value
    > > ----------END-----------
    > >
    > > When I run this code, my tracelist comes out with
    > >
    > > ---------BEGIN----------
    > > 2005-09-15 16:43:37
    > > about to attempt the IMPERSONATE
    > > Impersonate logon step 0
    > > Impersonate logon step 1
    > > Impersonate Logon Error: pywintypes.error (1314, 'LogonUser', 'A
    required
    > > privilege is not held by the client.')
    > > ----------END-----------
    > >
    > >
    > > I'm coding this in Python 2.4 and the Windows extensions. I have a
    > > number of other CGI programs in Python running under IIS that work
    > > correctly, but those only do database accesses. This one I'm trying to
    > > put together is the first one to actually do file searches.
    > >
    > >
    > > I have set the privileges for the logged on account on my IIS box for
    > > SE_TCB_NAME, SE_CHANGE_NOTIFY_NAME and SE_ASSIGNPRIMARYTOKEN_NAME and
    > > rebooted. To no avail. I'm not sure if there are additional
    > > alterations that need to be done to the security policies or not.
    > > Again, I'm not a guru.
    > >
    > >
    > > If anyone can give me more information/guidance I would greatly
    > > appreciate it. If you need more information from me, I will do my best
    > > to provide it.
    > >
    > > TIA,
    > >
    > > Paul
    > >
    > >
    >
    >

  • Next message: Steve Schofield: "Re: iis6 & asp.net 1.1: asp app cannot access folder"

    Relevant Pages

    • What is the most commond language for form processing-linux/unix servers
      ... are the standards script in? ... are they in cgi or php? ... Paul ...
      (comp.lang.php)
    • RE: mailto link
      ... If you want automation you'll have to write a program to do it (eg .php or ... "Paul M" wrote: ...
      (microsoft.public.frontpage.client)
    • Re: Domino 5.0.12 and IIS 5.0 problem
      ... >Execute Access Forbidden You have attempted to execute a CGI, ISAPI, ... >or other executable program from a directory that does not allow ... Paul Lynch ...
      (microsoft.public.inetserver.iis.security)
    • Re: Special K advert
      ... Sounds unlikely to me - it's gotta be cheaper to hire some unknown, than pay tens of thousands for CGI? ... Paul 'Charts Fan' Hyett ...
      (uk.media.tv.misc)
    • RE: mailto link
      ... If you want automation you'll have to write a program to do it (eg .php or ... "Paul M" wrote: ...
      (microsoft.public.frontpage.client)