Uploaded image for project: 'Puppet'
  1. Puppet
  2. PUP-8939

Administrators are not able to run puppet agent when installed as SYSTEM in some cases

    XMLWordPrintable

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: PUP 5.5.1
    • Fix Version/s: PUP 4.10.13, PUP 6.0.0
    • Component/s: None
    • Labels:
      None
    • Template:
    • Acceptance Criteria:
      • As an administrator I should be able to interactively run puppet agent no matter the original installation method.
    • Epic Link:
    • Team:
      Windows
    • Story Points:
      1
    • Sprint:
      Windows 2018-07-18, Windows 2018-07-25
    • CS Priority:
      Normal
    • CS Frequency:
      3 - 25-50% of Customers
    • CS Severity:
      3 - Serious
    • CS Business Value:
      4 - $$$$$
    • CS Impact:
      Hide
      Customers might assume that running puppet agent -t it would have the same result as a normal puppet daemon run, but it doesn't because puppet runs as LOCALSYSTEM when it's a daemon, but as the user calling it when it's run as puppet agent -t.

      It would seem as though we want puppet to assign permissions to the LocalAdministrator group no matter which user it runs under(LOCALSYSTEM or a administrator) to avoid these oddities.
      Show
      Customers might assume that running puppet agent -t it would have the same result as a normal puppet daemon run, but it doesn't because puppet runs as LOCALSYSTEM when it's a daemon, but as the user calling it when it's run as puppet agent -t. It would seem as though we want puppet to assign permissions to the LocalAdministrator group no matter which user it runs under(LOCALSYSTEM or a administrator) to avoid these oddities.
    • Zendesk Ticket IDs:
      34512
    • Zendesk Ticket Count:
      1
    • Release Notes:
      Not Needed

      Description

      This issue was created from the work in PUP-6729

      —

      In some instances when Puppet Agent is installed as SYSTEM, the local administrators are unable to run puppet agent interactively.

        Attachments

          Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. PA-1165 Windows - pxp-agent.conf & server.cfg can only be accessed by local system account

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Needs Information

          Bug - A problem which impairs or prevents the functions of the product. PUP-9719 Cannot run Puppet Agent as Administrator if first PA run is done as System

          • Major - Major loss of function.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. BKR-1478 beaker-pe should not backup the client_data directory

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. PA-910 windows agent permission errors

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. PA-2019 Privilege escalation via %ProgramData%\PuppetLabs on Windows

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. PUP-7793 Puppet agent replacing transactionstore.yaml on first run after boot

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. PUP-9106 Windows file system ACLs should always write SYSTEM: (F)

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

          Task - A task that needs to be done. PUP-8771 Write integration/acceptance tests for NTFS permissions for PUP-6729

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. PUP-6729 NTFS permissions should be recalculated given SYSTEM is an implicit member of local Administrators

          • Major - Major loss of function.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. PUP-9068 Windows admin? check should consider group membership

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. PUP-5491 The "client_data" Directory Permissions Incorrect After Installation

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. PUP-266 Allow puppet to manage owner & group file settings (Redmine 18342)

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. PUP-4684 windows file resource doesn't grant group full permissions

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

            Activity

              People

              Assignee:
              ethan Ethan Brown
              Reporter:
              glenn.sarti Glenn Sarti
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Zendesk Support