Jira (PUP-9814) pxp-agent.conf file missing Administrators rights when puppet agent run as SYSTEM

[John O'Connor (JIRA)]

John O'Connor created an issue

Puppet / PUP-9814 pxp-agent.conf file missing Administrators rights when puppet agent run as SYSTEM Issue Type: Bug Affects Versions: PUP 6.4.2 Assignee: John O'Connor Created: 2019/07/05 7:59 AM Priority: Major Reporter: John O'Connor Puppet Version: 6.4.2 Puppet Server Version: N/A OS Name/Version: Windows Server 2016 x64 This is a follow on issue from PUP-9719 to deal with the specific file pxp-agent.conf. Although the main work for PUP-9719 appears to correct the permissions/rights issue for the cache files additional work is needed to resolve the issue for C:\ProgramData/PuppetLabs/pxp-agent/etc/pxp-agent.conf Desired Behavior: Puppet Agent should run without error under Administrator Actual Behavior: Running the Puppet Agent command as Administrator gives the following result PS C:\Users\Administrator> puppet agent -t Info: Using configured environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Retrieving locales Info: Loading facts Info: Caching catalog for umtzu5243z6go5b.delivery.puppetlabs.net Info: Applying configuration version '1562236108' Error: /Stage[main]/Puppet_enterprise::Pxp_agent/File[C:\ProgramData/PuppetLabs/pxp-agent/etc/pxp-agent.conf]: Could not evaluate: Could not read file C:\ProgramData/PuppetLabs/pxp-agent/etc/pxp-agent.conf: Permission denied @ rb_sysope - C:/ProgramData/PuppetLabs/pxp-agent/etc/pxp-agent.conf Notice: /Stage[main]/Puppet_enterprise::Pxp_agent::Service/Service[pxp-agent]: Dependency File[C:\ProgramData/PuppetLabs/pxp-agent/etc/pxp-agent.conf] has failures: true Warning: /Stage[main]/Puppet_enterprise::Pxp_agent::Service/Service[pxp-agent]: Skipping because of failed dependencies Notice: Applied catalog in 0.19 seconds PS C:\Users\Administrator> puppet agent -t Info: Using configured environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Retrieving locales Info: Loading facts Info: Caching catalog for umtzu5243z6go5b.delivery.puppetlabs.net Info: Applying configuration version '1562236108' Notice: Applied catalog in 0.19 seconds Add Comment

This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)

[John O'Connor (JIRA)]

John O'Connor assigned an issue to Unassigned

Puppet / PUP-9814 pxp-agent.conf file missing Administrators rights when puppet agent run as SYSTEM

Change By: John O'Connor Assignee: John O'Connor

Add Comment

[Mihai Buzgau (JIRA)]

Mihai Buzgau updated an issue

Puppet / PUP-9814 pxp-agent.conf file missing Administrators rights when puppet agent run as SYSTEM

Change By: Mihai Buzgau Sprint: PR - Triage

Add Comment

[Mihai Buzgau (JIRA)]

Mihai Buzgau updated an issue

Puppet / PUP-9814 pxp-agent.conf file missing Administrators rights when puppet agent run as SYSTEM

Change By: Mihai Buzgau Sprint: PR - Triage 2019-07-23

Add Comment

[Gabriel Nagy (JIRA)]

Gabriel Nagy assigned an issue to Gabriel Nagy

Puppet / PUP-9814 pxp-agent.conf file missing Administrators rights when puppet agent run as SYSTEM

Change By: Gabriel Nagy Assignee: Gabriel Nagy

Add Comment

[Mihai Buzgau (JIRA)]

Mihai Buzgau updated an issue

Puppet / PUP-9814 pxp-agent.conf file missing Administrators rights when puppet agent run as SYSTEM

Change By: Mihai Buzgau Sprint: PR - 2019-07-23 , NW - 2019-08-07

Add Comment

[Gabriel Nagy (JIRA)]

Gabriel Nagy commented on PUP-9814

Re: pxp-agent.conf file missing Administrators rights when puppet agent run as SYSTEM Looks like pxp-agent.conf comes from here: https://github.com/puppetlabs/puppet-enterprise-modules/blob/irving/modules/puppet_enterprise/manifests/pxp_agent.pp#L105

Add Comment

[John O'Connor (JIRA)]

John O'Connor commented on PUP-9814

Re: pxp-agent.conf file missing Administrators rights when puppet agent run as SYSTEM

Thanks Gabriel Nagy - I'm thinking there are two ways we could tackle this one: Modify the modify to explicitly set the Group to Administrators (my preference) Intercept the file: type and ensure any files under ProgramData\PuppetLabs or a sub-directory of that have group set as Administrators (quite a hacky approach hence my preference for the other). /cc Gheorghe Popescu

Add Comment