Re: Calling WNetAddConnection() from a service
- From: "Joe Richards [MVP]" <humorexpress@xxxxxxxxxxx>
- Date: Sun, 07 May 2006 15:42:09 -0400
Doesn't matter if this stuff has been working this way since UNIVAC-I; the underlying OS pieces are changing and working more and more against you. The fact that the code is so old leads me to believe there are probably just an amazing mess of issues in it anyway has it has been hacked for this that and other function.
Someone really needs to start looking at re-architecting and rewriting which obviously assumes that it was initially architected and not just grown up the way it is which I expect is a stretch in thinking from what I have seen from most vendors. I have done a lot of work on old OS/2 systems back in the late 90's moving them to NT and in each case I could see trying to run them like they ran on OS/2 was more hassle and insecure than was necessary (or truly acceptable) so I re-architected them. It requires understanding the need and then looking at it from the Windows viewpoint on how to solve.
Check out this article to start, it gives more insight into what I am saying. Notice the trend in how drive letters are being handled.
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q180362
Again, you can map drives as localsystem, the person who said that was incorrect. You can do it by specifying any security context or by using the computer's security context if you are using kerberos for authentication. Or even, if you really don't care about security, null session shares. I have found valid cases over the last 10-12 or so years where a null session share was ok from a security stand point (read only access to info anyone could get anyway such as shared application binaries, etc).
It is probably good you don't mention what company this is because I expect every person who saw this chain that used that product would be (or at least should be) scared.
Overall though, and you can feed this straight to your highest management from a very visible someone who does a lot of consulting to large enterprises and working with vendors that if I encounter their app, they can expect me to tell customers don't even consider running it. I have ripped more than one app out of companies when I am asked to review them and determine if they are good from a security/efficiency standpoint. I am also a developer and understand the difference between doing things because of technical issues or other reasons. If you guys don't start fixing this stuff you will just get worse and worse off until you have nothing you can really use. To put it another way, putting it off more and more will make it more and more expensive to correct, development time isn't getting cheaper and I don't forsee anything coming out that will magically solve your issue until someone really figures out the requirements so they know what to look for.
joe
--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net
---O'Reilly Active Directory Third Edition now available---
http://www.joeware.net/win/ad3e.htm
EricC wrote:
Kellie, Joe, Chris,.
Thank you for the replies.
Let me try to describe this a little better. For starts, this is a project that I've inherited. Perhaps what I'm trying to do here is fundamentally undoable. In which case, I need to find another way to get something done.
The company has a number of legacy products dating back to the early 1990's that ship on different schedules. These products communicate on a port to an application that runs on the server. The drawback of the application is that it requires someone to be logged in for it to start up. We've made a service that starts up when the OS starts. The service has a C# wrapper that calls an unmanaged DLL from the same code as the application. That works fine, but we need network drive access because the server that handles requests doesn't necessarily have the data stored on it. So, I need the service to find network drives while not logged in and assign them drive letters.
From reading your replies, is there a way for me to configure my service to run as something other than localSystem so that I can assign drive letters?
Joe, I take your point about not using drive letters but I'm stuck on this one. The core of this code dates back to the OS/2 days. We're talking about millions of lines of code in the applications. There is a lot of drive letter data and logic in these applications. They aren't going to allow me to rip that stuff out.
Any insights are appreciated.
-E
- Prev by Date: Finding hidden process
- Next by Date: Re: LookupAccountName behavior dependent upon operating system of global catalog (GC)
- Previous by thread: Re: Calling WNetAddConnection() from a service
- Next by thread: (Not)Default CSP and VerifySignature's behavior
- Index(es):
Relevant Pages
|
