Bug #27051 [Csd]: Impersonation with FastCGI does not EXEC process as impersonated user

From:	pajoye@php.net	Date:	Wed, 24 Mar 2010 21:48:18 +0000
Subject:	Bug #27051 [Csd]: Impersonation with FastCGI does not EXEC process as impersonated user
References:	1	Groups:	php.bugs
Request:	Send a blank email to php-bugs+get-148951@lists.php.net to get a copy of this message

Edit report at http://bugs.php.net/bug.php?id=27051&edit=1

 ID:               27051
 Updated by:       pajoye@php.net
 Reported by:      ghoffer at globalscape dot com
 Summary:          Impersonation with FastCGI does not EXEC process as
                   impersonated user
 Status:           Closed
 Type:             Bug
 Package:          CGI related
 Operating System: Windows
 PHP Version:      5.3
 Assigned To:      pajoye

 New Comment:

Again, I did check in all possible configurations and it does work.

However please configure impersonation correctly for FastCGI (that's not
the App pool settings).


Previous Comments:
------------------------------------------------------------------------
[2010-03-24 22:45:31] heer2351 at zonnet dot nl

Thanks for your fast response.

I am running the website using an application pool and have configured a
special user for that pool. I use the same user for anonymous access. So
both the website as well as PHP use the same identity. This user has all
the required rights. 

Just to test I have given this user rights to %COMSPEC% using cacls.
Same error.
Gave IUSR_xxx rights, same error.
Gave IWAM_xxx rights, same error.

Please check what has changed between 5.2.13 and 5.3.2

------------------------------------------------------------------------
[2010-03-24 22:14:23] pajoye@php.net

Let me copy my note here as well:

Quick note here. It is necessary to give a given IUSR_* the permission
to use cmd.exe (%COMSPEC%). It is recommended not to do it as it may
introduce security issues, obviously. But if you really want to do it,
use:

cacls %COMSPEC% /E /G IUSR_xxxx:R

------------------------------------------------------------------------
[2010-03-24 22:09:25] pajoye@php.net

you have >to give< the permission

------------------------------------------------------------------------
[2010-03-24 22:08:58] pajoye@php.net

It works just fine and you have the permission to the IIS user to
execute the shell. See the other reports about that, I added the
explanation and how to configure it correctly there.

------------------------------------------------------------------------
[2010-03-24 21:43:39] heer2351 at zonnet dot nl

PHP 5.3.2 (cgi-fcgi) (built: Mar  3 2010 20:47:00)
FastCGI DLL Version 7.5.7693.0
Microsoft Windows Server 2003R2
IIS6

Exact same problem - PHP Warning: exec(): Unable to fork 
Changed PHP back to:
  PHP 5.2.13 (cgi-fcgi) (built: Feb 24 2010 14:37:42)

No fork problem, so it is not a configuration problem.

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    http://bugs.php.net/bug.php?id=27051


-- 
Edit this bug report at http://bugs.php.net/bug.php?id=27051&edit=1


   

Thread (50 messages)

• ghoffer at globalscape dot comMon, 26 Jan 2004 20:41:15 +0000
  • aheckmann at m-s dot deThu, 21 Jun 2007 18:06:46 +0000#27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • louis at steelbytes dot comMon, 08 Dec 2008 23:04:23 +0000#27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • louis at steelbytes dot comTue, 09 Dec 2008 00:45:44 +0000#27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • tgross at m-s dot deWed, 24 Jun 2009 15:12:12 +0000#27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • nathan at andersonsplace dot netThu, 27 Aug 2009 19:17:38 +0000#27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netThu, 27 Aug 2009 22:20:40 +0000#27051 [Opn->Asn]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netTue, 01 Sep 2009 22:51:47 +0000#27051 [Asn->Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • benadler at gmx dot netThu, 03 Sep 2009 15:52:25 +0000#27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netThu, 03 Sep 2009 21:17:46 +0000#27051 [Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • benadler at gmx dot netSun, 06 Sep 2009 18:13:09 +0000#27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • benadler at gmx dot netMon, 07 Sep 2009 11:11:06 +0000#27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • benadler at gmx dot netMon, 07 Sep 2009 11:17:14 +0000#27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netMon, 07 Sep 2009 11:34:10 +0000#27051 [Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • benadler at gmx dot netMon, 07 Sep 2009 22:42:29 +0000#27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netTue, 08 Sep 2009 17:58:55 +0000#27051 [Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netTue, 22 Sep 2009 20:04:57 +0000#27051 [NoF->Asn]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netTue, 22 Sep 2009 20:11:10 +0000#27051 [Asn->Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • louis at steelbytes dot comFri, 20 Nov 2009 00:52:52 +0000#27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • jfjauvin at gmail dot comWed, 03 Feb 2010 00:13:23 +0000#27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 03 Feb 2010 00:38:52 +0000#27051 [NoF->Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 20:43:39 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 21:08:59 +0000Bug #27051 [NoF->Csd]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 21:09:25 +0000Bug #27051 [Csd]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 21:14:23 +0000Bug #27051 [Csd]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 21:45:31 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 21:48:18 +0000Bug #27051 [Csd]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 21:51:11 +0000Bug #27051 [Csd]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 22:04:59 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 22:07:39 +0000Bug #27051 [Csd->Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 22:17:05 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 22:22:19 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 22:39:38 +0000Bug #27051 [Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 22:40:45 +0000Bug #27051 [Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 22:50:21 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 22:53:10 +0000Bug #27051 [Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 22:56:21 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 22:58:27 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 23:00:09 +0000Bug #27051 [Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 23:04:10 +0000Bug #27051 [Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 23:08:31 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 23:09:56 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 23:11:57 +0000Bug #27051 [Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 23:13:33 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 23:17:50 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 23:30:20 +0000Bug #27051 [Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlWed, 24 Mar 2010 23:40:56 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netWed, 24 Mar 2010 23:45:36 +0000Bug #27051 [Fbk]: Impersonation with FastCGI does not EXEC process as impersonated user
  • heer2351 at zonnet dot nlThu, 25 Mar 2010 12:08:22 +0000Bug #27051 [Com]: Impersonation with FastCGI does not EXEC process as impersonated user
  • pajoye@php.netThu, 25 Mar 2010 13:33:05 +0000Bug #27051 [Fbk->Tbd]: Impersonation with FastCGI does not EXEC process as impersonated user