Home / user-191426

Bunyk's questions

Martin Hope
Bunyk
Asked: 2018-10-17 05:36:39 +0800 CST
  • -1

I'm using Docker 18.06.1-ce on Ubuntu 16, and I have a container exposing 8012 port. When I do

curl "http://localhost:8012/"

I get response 

Error: Requested URL / not found

But when VPN is up (openfortivpn) after long time waiting I get 

curl: (56) Recv failure: Connection reset by peer

When I mess my port number, I instantly get error:

curl "http://localhost:8011/"
curl: (7) Failed to connect to localhost port 8011: Connection refused

How to debug and fix this? Obviously localhost pings, and traceroute to it is one hop.

vpn
Martin Hope
Bunyk
Asked: 2014-04-23 02:27:39 +0800 CST
  • 7

I have Windows Server 2012 (and Server 2008, but it is next priority) to monitor it using txwinrm. txwinrm library internally is using WinRS protocol. I have to monitor it using least privileged user, but don't know how to configure access for him.

All I managed to do - is to configure remote Powershell session for my user, but it's look like that winrs and powershell sessions have different security descriptors:

Invoke-Command -ComputerName 192.168.173.206 -Credential (credential Administrator $pwd) -ScriptBlock { 2 + 2}
# gives 4
Invoke-Command -ComputerName 192.168.173.206 -Credential (credential lpu1 $pwd) -ScriptBlock { 2 + 2}
# gives 4
winrs -r:192.168.173.206 -u:Administrator -p:$pwd 'powershell -command "2+2"'
# gives 4
winrs -r:192.168.173.206 -u:lpu1 -p:$pwd 'powershell -command "2+2"'
# Gives Winrs error: Access is denied.

Configuration for my user is following:

(Get-Item WSMan:\localhost\Service\RootSDDL).value
# O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-3231263931-1371906242-1889625497-1141)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)
(Get-PSSessionConfiguration -name Microsoft.Powershell).SecurityDescriptorSddl
# O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-3231263931-1371906242-1889625497-1149)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)

(In each security descriptor my user is given general access to protected object).

So what security descriptor should I set to make my winrs query work for non-admin user?

UPD: Recently I found that that I could retrieve information about winrm shells:

  winrm enumerate shell
Shell
    ShellId = 3793B153-CCCF-4500-99FB-8534074E1738
    ResourceUri = http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd

And I found no such resource URI in WSMan:\localhost\Plugin directory. :( Documentation states:

The resource URI can be used to retrieve plug-in configuration that is specific to the shell instance.

But how to retrieve that plugin configuration and how to change it?

windows
Martin Hope
Bunyk
Asked: 2014-04-15 01:12:36 +0800 CST
  • 0

I am trying to monitor windows machine with the help of wmi and powershell remoting. I managed to successfully start remote session with that machine throught non-admin user account, but now I have a problem with running WMI queries. My user is in the following groups (I followed this answer to setup account for that user):

[192.168.173.206]: PS C:\Users\lpu\Documents> Get-ADPrincipalGroupMembership $env:username | Format-table name

name                                                                                                                                                                                                                                           
----                                                                                                                                                                                                                                           
Domain Users                                                                                                                                                                                                                                   
Performance Monitor Users                                                                                                                                                                                                                      
Distributed COM Users                                                                                                                                                                                                                          
Remote Management Users                                                                                                                                                                                                                        



____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________
[192.168.173.206]: PS C:\Users\lpu\Documents> os_caption
Get-WmiObject : Access denied 
At line:2 char:6
+     (Get-WmiObject -class Win32_OperatingSystem).Caption
+      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand
windows