|
security
newsgroups
|
|||||||||||||||||||||||
|
|||||||||||||||||||||||
Event Log Write access under ASP.NETI'm trying to write to the Windows event log from an ASP.NET application
which is impersonating a local user (through p/invoke LogonUser and .NET impersionation). Although the user I am impersonating can write successfully when interactively logged on, I get an Access Denied result from the interop call to advapi32's RegisterEventSource when impersonating this same user under ASP.NET. If I make said user member of Administrators, it works, but I have not been able to figure out what permission or privilege is necessary for the non-admin to function in this scenario. Anyone have a guess as to why this may be or what permissions to try? Thanks, Jeremy Further clarification: The event source has already been created, I am
trying to write to a source I know exists. Show quoteHide quote "Jeremy Lew" <js***@hotmail.com> wrote in message news:OJzj$8nRFHA.1096@tk2msftngp13.phx.gbl... > I'm trying to write to the Windows event log from an ASP.NET application > which is impersonating a local user (through p/invoke LogonUser and .NET > impersionation). Although the user I am impersonating can write > successfully when interactively logged on, I get an Access Denied result > from the interop call to advapi32's RegisterEventSource when impersonating > this same user under ASP.NET. If I make said user member of Administrators, > it works, but I have not been able to figure out what permission or > privilege is necessary for the non-admin to function in this scenario. > > Anyone have a guess as to why this may be or what permissions to try? > > Thanks, > Jeremy > > > What is the name of the event log under which the source is registered?
Show quoteHide quote "Jeremy Lew" <js***@hotmail.com> wrote in message news:uiJcw%23nRFHA.3944@TK2MSFTNGP10.phx.gbl... > Further clarification: The event source has already been created, I am > trying to write to a source I know exists. > > "Jeremy Lew" <js***@hotmail.com> wrote in message > news:OJzj$8nRFHA.1096@tk2msftngp13.phx.gbl... >> I'm trying to write to the Windows event log from an ASP.NET application >> which is impersonating a local user (through p/invoke LogonUser and .NET >> impersionation). Although the user I am impersonating can write >> successfully when interactively logged on, I get an Access Denied result >> from the interop call to advapi32's RegisterEventSource when >> impersonating >> this same user under ASP.NET. If I make said user member of > Administrators, >> it works, but I have not been able to figure out what permission or >> privilege is necessary for the non-admin to function in this scenario. >> >> Anyone have a guess as to why this may be or what permissions to try? >> >> Thanks, >> Jeremy >> >> >> > > It's the Application log.
Show quoteHide quote "Nicole Calinoiu" <calinoiu REMOVETHIS AT gmail DOT com> wrote in message news:ezLMoFoRFHA.3496@TK2MSFTNGP12.phx.gbl... > What is the name of the event log under which the source is registered? > > > "Jeremy Lew" <js***@hotmail.com> wrote in message > news:uiJcw%23nRFHA.3944@TK2MSFTNGP10.phx.gbl... > > Further clarification: The event source has already been created, I am > > trying to write to a source I know exists. > > > > "Jeremy Lew" <js***@hotmail.com> wrote in message > > news:OJzj$8nRFHA.1096@tk2msftngp13.phx.gbl... > >> I'm trying to write to the Windows event log from an ASP.NET application > >> which is impersonating a local user (through p/invoke LogonUser and ..NET > >> impersionation). Although the user I am impersonating can write > >> successfully when interactively logged on, I get an Access Denied result > >> from the interop call to advapi32's RegisterEventSource when > >> impersonating > >> this same user under ASP.NET. If I make said user member of > > Administrators, > >> it works, but I have not been able to figure out what permission or > >> privilege is necessary for the non-admin to function in this scenario. > >> > >> Anyone have a guess as to why this may be or what permissions to try? > >> > >> Thanks, > >> Jeremy > >> > >> > >> > > > > > > What code are you using for the failed logging operation?
Show quoteHide quote "Jeremy Lew" <js***@hotmail.com> wrote in message news:%23ZYijJoRFHA.1096@tk2msftngp13.phx.gbl... > It's the Application log. > > "Nicole Calinoiu" <calinoiu REMOVETHIS AT gmail DOT com> wrote in message > news:ezLMoFoRFHA.3496@TK2MSFTNGP12.phx.gbl... >> What is the name of the event log under which the source is registered? >> >> >> "Jeremy Lew" <js***@hotmail.com> wrote in message >> news:uiJcw%23nRFHA.3944@TK2MSFTNGP10.phx.gbl... >> > Further clarification: The event source has already been created, I am >> > trying to write to a source I know exists. >> > >> > "Jeremy Lew" <js***@hotmail.com> wrote in message >> > news:OJzj$8nRFHA.1096@tk2msftngp13.phx.gbl... >> >> I'm trying to write to the Windows event log from an ASP.NET > application >> >> which is impersonating a local user (through p/invoke LogonUser and > .NET >> >> impersionation). Although the user I am impersonating can write >> >> successfully when interactively logged on, I get an Access Denied > result >> >> from the interop call to advapi32's RegisterEventSource when >> >> impersonating >> >> this same user under ASP.NET. If I make said user member of >> > Administrators, >> >> it works, but I have not been able to figure out what permission or >> >> privilege is necessary for the non-admin to function in this scenario. >> >> >> >> Anyone have a guess as to why this may be or what permissions to try? >> >> >> >> Thanks, >> >> Jeremy >> >> >> >> >> >> >> > >> > >> >> > > Hello Jeremy,
is it Windows 2003? --------------------------------------- Dominick Baier - DevelopMentor http://www.leastprivilege.com Show quoteHide quote > I'm trying to write to the Windows event log from an ASP.NET > application which is impersonating a local user (through p/invoke > LogonUser and .NET impersionation). Although the user I am > impersonating can write successfully when interactively logged on, I > get an Access Denied result from the interop call to advapi32's > RegisterEventSource when impersonating this same user under ASP.NET. > If I make said user member of Administrators, it works, but I have not > been able to figure out what permission or privilege is necessary for > the non-admin to function in this scenario. > > Anyone have a guess as to why this may be or what permissions to try? > > Thanks, > Jeremy Dimonick, yes it is 2003, although I need to make it work on 2000 Server
eventually too. To answer Nicole's question, the call which is failing is: EventLog.WriteEntry("Some Message","MyEventSouce") I have disassembled WriteEntry, and I'm fairly sure what is actually failing is the internal P/INVOKE call to the advapi32 RegisterEventSource function. The managed code constructs a Win32Exception from this. In other words, this is not a really .NET problem, it's a Win32 security problem. Jeremy Show quoteHide quote "Dominick Baier [DevelopMentor]" <dbaier@pleasepleasenospamdevelop.com> wrote in message news:288435632497012335810912@news.microsoft.com... > Hello Jeremy, > > is it Windows 2003? > > > --------------------------------------- > Dominick Baier - DevelopMentor > http://www.leastprivilege.com > > > I'm trying to write to the Windows event log from an ASP.NET > > application which is impersonating a local user (through p/invoke > > LogonUser and .NET impersionation). Although the user I am > > impersonating can write successfully when interactively logged on, I > > get an Access Denied result from the interop call to advapi32's > > RegisterEventSource when impersonating this same user under ASP.NET. > > If I make said user member of Administrators, it works, but I have not > > been able to figure out what permission or privilege is necessary for > > the non-admin to function in this scenario. > > > > Anyone have a guess as to why this may be or what permissions to try? > > > > Thanks, > > Jeremy > > > Hello Jeremy,
in w2k3 you can set ACLs on Event Logs - this is done by using an SDDL (Security Descriptor Description Language). The default for the Application Log is O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA) (A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3) (nice, eh?) found under : HKEY_LOCAL_MACHINE\System\CurrentControlSet\?Services\Eventlog\Application\CustomSD this basically means service accounts/admins have read/write - no one else you can find more info on SDDL via http://msdn.microsoft.com/library/en-us/security/security/security_descriptor_string_format.asp and more info on how to change that settings: http://msdn.microsoft.com/library/en-us/dncode/html/secure06122003.asp HTH --------------------------------------- Dominick Baier - DevelopMentor http://www.leastprivilege.com Show quoteHide quote > Dimonick, yes it is 2003, although I need to make it work on 2000 > Server eventually too. > > To answer Nicole's question, the call which is failing is: > EventLog.WriteEntry("Some Message","MyEventSouce") > > I have disassembled WriteEntry, and I'm fairly sure what is actually > failing is the internal P/INVOKE call to the advapi32 > RegisterEventSource function. The managed code constructs a > Win32Exception from this. In other words, this is not a really .NET > problem, it's a Win32 security problem. > > Jeremy > > "Dominick Baier [DevelopMentor]" > <dbaier@pleasepleasenospamdevelop.com> wrote in message > news:288435632497012335810912@news.microsoft.com... > >> Hello Jeremy, >> >> is it Windows 2003? >> >> --------------------------------------- >> Dominick Baier - DevelopMentor >> http://www.leastprivilege.com >>> I'm trying to write to the Windows event log from an ASP.NET >>> application which is impersonating a local user (through p/invoke >>> LogonUser and .NET impersionation). Although the user I am >>> impersonating can write successfully when interactively logged on, I >>> get an Access Denied result from the interop call to advapi32's >>> RegisterEventSource when impersonating this same user under ASP.NET. >>> If I make said user member of Administrators, it works, but I have >>> not been able to figure out what permission or privilege is >>> necessary for the non-admin to function in this scenario. >>> >>> Anyone have a guess as to why this may be or what permissions to >>> try? >>> >>> Thanks, >>> Jeremy "Dominick Baier [DevelopMentor]" <dbaier@pleasepleasenospamdevelop.com> <snip>wrote in message news:291692632497616544227040@news.microsoft.com... > this basically means service accounts/admins have read/write - no one else Also the interactive logon user, which was probably the main cause of troubleshooting difficulty in this particular scenario. (Or at least it was for me. <g>) Show quoteHide quote > > you can find more info on SDDL via > http://msdn.microsoft.com/library/en-us/security/security/security_descriptor_string_format.asp > > and more info on how to change that settings: > http://msdn.microsoft.com/library/en-us/dncode/html/secure06122003.asp > > HTH > > --------------------------------------- > Dominick Baier - DevelopMentor > http://www.leastprivilege.com > >> Dimonick, yes it is 2003, although I need to make it work on 2000 >> Server eventually too. >> >> To answer Nicole's question, the call which is failing is: >> EventLog.WriteEntry("Some Message","MyEventSouce") >> >> I have disassembled WriteEntry, and I'm fairly sure what is actually >> failing is the internal P/INVOKE call to the advapi32 >> RegisterEventSource function. The managed code constructs a >> Win32Exception from this. In other words, this is not a really .NET >> problem, it's a Win32 security problem. >> >> Jeremy >> >> "Dominick Baier [DevelopMentor]" >> <dbaier@pleasepleasenospamdevelop.com> wrote in message >> news:288435632497012335810912@news.microsoft.com... >> >>> Hello Jeremy, >>> >>> is it Windows 2003? >>> >>> --------------------------------------- >>> Dominick Baier - DevelopMentor >>> http://www.leastprivilege.com >>>> I'm trying to write to the Windows event log from an ASP.NET >>>> application which is impersonating a local user (through p/invoke >>>> LogonUser and .NET impersionation). Although the user I am >>>> impersonating can write successfully when interactively logged on, I >>>> get an Access Denied result from the interop call to advapi32's >>>> RegisterEventSource when impersonating this same user under ASP.NET. >>>> If I make said user member of Administrators, it works, but I have >>>> not been able to figure out what permission or privilege is >>>> necessary for the non-admin to function in this scenario. >>>> >>>> Anyone have a guess as to why this may be or what permissions to >>>> try? >>>> >>>> Thanks, >>>> Jeremy > > > Yes, this was the answer. I had to add a "A;;0x0002;;;AU" to grant write to
authenticated users. Thanks for the tip! Show quoteHide quote "Nicole Calinoiu" <calinoiu REMOVETHIS AT gmail DOT com> wrote in message http://msdn.microsoft.com/library/en-us/security/security/security_descriptor_string_format.aspnews:OYgUnwyRFHA.3712@TK2MSFTNGP10.phx.gbl... > "Dominick Baier [DevelopMentor]" <dbaier@pleasepleasenospamdevelop.com> > wrote in message news:291692632497616544227040@news.microsoft.com... > <snip> > > this basically means service accounts/admins have read/write - no one else > > Also the interactive logon user, which was probably the main cause of > troubleshooting difficulty in this particular scenario. (Or at least it was > for me. <g>) > > > > > > you can find more info on SDDL via > > Show quoteHide quote > > > > and more info on how to change that settings: > > http://msdn.microsoft.com/library/en-us/dncode/html/secure06122003.asp > > > > HTH > > > > --------------------------------------- > > Dominick Baier - DevelopMentor > > http://www.leastprivilege.com > > > >> Dimonick, yes it is 2003, although I need to make it work on 2000 > >> Server eventually too. > >> > >> To answer Nicole's question, the call which is failing is: > >> EventLog.WriteEntry("Some Message","MyEventSouce") > >> > >> I have disassembled WriteEntry, and I'm fairly sure what is actually > >> failing is the internal P/INVOKE call to the advapi32 > >> RegisterEventSource function. The managed code constructs a > >> Win32Exception from this. In other words, this is not a really .NET > >> problem, it's a Win32 security problem. > >> > >> Jeremy > >> > >> "Dominick Baier [DevelopMentor]" > >> <dbaier@pleasepleasenospamdevelop.com> wrote in message > >> news:288435632497012335810912@news.microsoft.com... > >> > >>> Hello Jeremy, > >>> > >>> is it Windows 2003? > >>> > >>> --------------------------------------- > >>> Dominick Baier - DevelopMentor > >>> http://www.leastprivilege.com > >>>> I'm trying to write to the Windows event log from an ASP.NET > >>>> application which is impersonating a local user (through p/invoke > >>>> LogonUser and .NET impersionation). Although the user I am > >>>> impersonating can write successfully when interactively logged on, I > >>>> get an Access Denied result from the interop call to advapi32's > >>>> RegisterEventSource when impersonating this same user under ASP.NET. > >>>> If I make said user member of Administrators, it works, but I have > >>>> not been able to figure out what permission or privilege is > >>>> necessary for the non-admin to function in this scenario. > >>>> > >>>> Anyone have a guess as to why this may be or what permissions to > >>>> try? > >>>> > >>>> Thanks, > >>>> Jeremy > > > > > > > > 
Other interesting topics
Encrypt with RijndaelManaged and decrypt with OpenSSL
UIPermission Clipboard IsAuthenticated property on IIdentity interface Logon user from service running dll from a network share Windows security context Windows Authentication Newbie Question Emulating the [PrincipalPermissionAttribute ...] attribute Help needed with TSL problem. AzMan - ADAM store. |
|||||||||||||||||||||||
