When I execute the command "iisreset" through an ssh terminal on a remote windows machine, I get the following error:
Attempting stop...
Restart attempt failed.
Access denied, you must be an administrator of the remote computer to use this
command. Either have your account added to the administrator local group of
the remote computer or to the domain administrator global group.
When I type whoami, it shows that I am the administrator. My cygwin ssh session is running as the "cyg_server" user who has admin privileges.
My ssh server is configured with privilege separation and allows me to login as administrator.
When I run the command locally, it works fine. The problem is execution through ssh.
I've also used process monitor to see what's going on, but it does not indicate the problem.
That is pretty strange because I am able to do admin-only operations in remote ssh such as:
echo "hi">/cygdrive/c/x.txt
rm /cygdrive/c/x.txt
Turning off UAC did not make a difference.
Any ideas?
I had a similar problem: unable to start/stop services using net start/net stop from a remote password-less (public/private key) SSH user. Attempting to start/stop the service was resulting in a "System Error 5 has occurred. Access is denied." error).
I had to install Cygwin's LSA authentication package (see http://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-setuid-overview) in order for (I presume) setuid to work properly for password-less logins.
The problem should go away once LSA is installed on the Cygwin/SSH host and the machine has been rebooted.
I got scared of the LSA package mentioned in #user3609241's answer because of this sentence in the LSA docs:
as soon as the LSA encounters serious problems (for instance, one of
the protected LSA processes died), it triggers a system reboot.
But, those same docs point to a very easy way to "runas" SYSTEM - just use the at command:
$ date
Mon, Jan 12, 2015 8:17:35 PM
$ at 20:18 iisreset
Added a new job with job ID = 1
$ at
Status ID Day Time Command Line
-------------------------------------------------------------------------------
1 Today 8:18 PM iisreset
It works, at the cost of having to wait up to 59 seconds.
(wrapping the above sequence of commands in a simple-to-call script is left as an exercise to the reader; our management util is written in Perl so it was pretty straightforward).
Run the Cygwin terminal as administrator
Related
I'm logging in to vSphere VM (FreeBSD) using SSH and getting the following error-
Shared object "libintl.so.9" not found, required by "bash"
Connection to xxx closed.
I mistakenly changed root user's shell to bash. I was able to login earlier using csh. I can't run chsh or any other commands because I am not able to login to the server.
Is there a way to revert the shell change or specify shell while SSH login? I have tried rebooting the VM using vSphere but still getting the same error.
I have also tried sftp using FileZilla but since it uses SSH, I am getting the following error-
Status: Connected to xxx
Error: FATAL ERROR: Received unexpected end-of-file from SFTP server
Error: Could not connect to server
To fix this, you will need to shutdown the VM from vsphere, reboot, then choose "Single User" mode. Once at the single user shell, change root's shell to /bin/sh or /bin/csh. Don't use 3rd part shells for root.
Also, you get the error because your bash binary is out of date and not ABI compatible with the OS it's installed. Using pkg update should help once you get access again.
My GCP VM instance was setup sometime back and all the services were working fine. However, suddenly from today I am not able to login via SSH and even an instance restart did not fix the issue. When checked the serial log, it seems to have stopped in this line,
[ 8.686861] intel_powerclamp: No package C-state
availableintel_powerclamp: No package C-state available[ 8.705723]
attempt to access beyond end of device [ 8.706721] sda1: rw=0,
want=41927608, limit=41927602 [[32m OK [0m] Started Security
Auditing Service.
Starting Update UTMP about System Boot/Shutdown...
32m OK [0m] Started Update UTMP about System Boot/Shutdown.
Starting Update UTMP about System Runlevel Changes...
32m OK [0m] Started Update UTMP about System Runlevel
ChanWelcome to emergency mode! AfterGive root password for maintenance
(or type Control-D to continue):
It won't proceed further to start SSH and other services, hence I am not able to login to the instance. Any help would be greatly appreciated.
Thanks in advance.
The error
No package C-state available
points to problems to mount the filesystem.
Did you try to follow the steps written in this other post ?
When you see Ctrl+D enter root password. Then enter mount -a to see in what line is the error.
Enter vi /etc/fstab and correct whatever is missing, save and reboot.
What you can do is logon to the serial console so you can interact with it. It will probably ask you for a root password and if you have not set that up, you can set that up through startup scripts.
I am unable to connect through SSH to my GCE instance. I was connecting without any problem, the only think I changes was my user name through top right corner of the browser then selected Change Linux Username.
When I try to ssh into my google engine via browser, I keep having following message in a endless loop:
When I try to ssh via cloud shell I also get following error message, (serial console output):
Permission denied (publickey).
ERROR: (gcloud.compute.ssh) [/usr/bin/ssh] exited with return code [255].
[Q] Is there any way to fix this problem? Since I have no access to the engine now, I don't know what to do.
However you could always get back access through serial console then from there you could internally y troubleshoot user/ssh issue.
1) $ gcloud compute instances add-metadata [INSTANCE_NAME] --metadata=serial-port-enable=1
You can then connect to the instance through the serial port
NOTE:The root password have must been already set in order to use the serial port
2)
$ gcloud compute connect-to-serial-port [INSTANCE_NAME]
If you never set the root password you could set it by adding a startup-script to your instance that will set a password as root by running the below command :
NOTE: the instance must be rebooted in order to run the startup script.
3) $ gcloud compute instances add-metadata [instance name] --metadata startup-script='echo "root:YourPasswdHere" | chpasswd'
Reboot the instance run the command on the step "2)" authenticate your self as root with the password that you set on the startup script in the step "3)" .
I had the same problem, It took me several days to figure out what was happening in my case.
To find out, I created a new instance from scratch and started making all modifications I've done to those that eventually couldn't connect to, one by one, exiting the ssh connection and re entering so as to test it.
I've tried it a couple of times, in both cases, the connection was impossible after uninstalling python (I only needed 3.7 version so I was uninstalling all others and installing that one I needed).
My command for uninstalling it was
sudo apt purge python2.7-minimal
and
sudo apt purge python3.5-minimal
I don't know if it was specifically because of deleting python, or because of using purge (in which case this problem might reproduce if using purge with another program).
I don't even know why would this affect ssh connection.
Could it be that google cloud is somehow using destination python for the ssh web?
In any case, if you are experiencing this problem try to avoid uninstalling anything from the base VM.
I just purchased new raspberry pi and tried to install raspbian using Noobs.
So the installation goes successfully and I boot into raspbian GUI successfully and make changes to raspi-config like to ask for the password when booting into GUI and enable various option like SSH,SCI and more. Then it reboots and gives me following error:
Raspberry pi Fatal server error: could not create lock file in /inp/.1xd-lock Please consult the X.org Foundation support at http://wiki.x.org for help
init: giving up
init: unable to connect to X server: Connection not sucessfull
init: server error nuth: error in locking authority file /home/pi/.xauthority
I have done this process so many time it is giving me same error every time. Any suggestion.......
Check your .xauthority file to make sure it's owned by the user you're logging in as rather than root. If it's owned by root, you can either change the ownership, or simply delete it and it will be recreated next time you attempt a login.
This has happened to me before!
It is likely your .xauthority file is corrupted, or root owns that file which means it won't let you boot into the GUI. Try this code and it seemed to work for me...
sudo chown -R pi:pi /home/pi
Basically what this is doing is it is reverting all the files' permission settings back to you, so the .Xauthority file for your account will be yours again.
BUT...
If the actual file itself is corrupt, then do this:
xauth -b
.Xauthority is not needed on startup, so it is safe to just delete it off your SD card, since a new version will be generated when you boot into the GUI.
I've written a script to search/download/install Windows Updates on a machine using the Microsoft.Update.Session COM Object. When run locally it works just fine, however when running through a remote session or through Invoke-Command I receive an access denied (0x80070005) error on Microsoft.Update.Session.CreateUpdateDownloader()
I receive the same error if I attempt to create a Downloader object directly, code to reproduce the issue:
$oUpdateDownloader = new-object -com "Microsoft.Update.Downloader"
I am an administrator on the remote machine, and passing credentials (for myself explicitly or any other admin account) to the machine does not seem to change anything.
I've seen this error posted a number of times but there does not seem to be any information on solving the problem...
Any ideas?
When you are in a remote PowerShell session your logon session on this remote computer is flagged as a "network" logon (Logon Type: 3).
For some obscure (security? sell SCCM?) reason, part of the Windows Update Agent COM APIs are restricted to only be usable by locally logged on Administrators.
Using PsExec and Scheduled Tasks have been suggested as workarounds.
IMO, the most seamless (and still secureable) solution is to facilitate the RunAs-style "Local Virtual Account" feature of PowerShell Session Configurations / JEA.
Usually, JEA is used to "restrict" what a user can do on a remote computer PowerShell-wise, but we are (ab-)using it here to gain full access as if we were a locally logged on Administrator.
(1.) Create a new unrestricted (and persistent!) session configuration on ComputerB (remote server):
New-PSSessionConfigurationFile -RunAsVirtualAccount -Path .\VirtualAccount.pssc
# Note this will restart the WinRM service:
Register-PSSessionConfiguration -Name 'VirtualAccount' [-ShowSecurityDescriptorUI] -Path .\VirtualAccount.pssc -Force
# Check the Permission property:
Get-PSSessionConfiguration -Name 'VirtualAccount'
# Those users will have full unrestricted access to the system!
(2.) From ComputerA (local client) connect to our unrestricted session configuration on ComputerB:
New-PSSession -ComputerName 'ComputerB' -ConfigurationName 'VirtualAccount' | Enter-PSSession
[ComputerB]: new-object -com "Microsoft.Update.Downloader" # Yay!
This is a known issue. It appears that there is a bug with the actual COM object itself, as this issue occurs when using VBScript, PowerShell, and even C#. There is a good article that discusses managing Windows Update with PowerShell that can be found here.
The workaround is to set up a scheduled task on the computer and you can invoke that task however you see fit.
Use PsExec (http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx) to remotely execute PowerShell with a script file:
psexec -s \\remote-server-name C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe \\server\script.ps1
I used the script detailed at http://www.ehow.com/how_8724332_use-powershell-run-windows-updates.html, and I can remotely execute it using psexec to download and install updates.
the windows update code isn't callable form a remote machine. there are a few workarounds out on the web, including using psexec and a script (powershell or vbscript).
I used WUInstall myself and BoeProx has documented a few alternatives and has started a project PoshPAIG. I moved jobs before using this so don't know if it works.
The other solution is to change Windows registry setting using PowerShell and optionally restart wuauserv for the changes to take effect.
For example in Windows Server 2008R2 AutoUpdate settings can be found at:
HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update