Ansible v2.6 become recursion issue #520
Labels
Comments
|
This looks like it should be a simple fix -- however I am worried about AIX target :) None of this code is tested on AIX |
|
I notice some issues:
If you log into the system, does cutpasting that command line produce a password prompt? If it does not, is it possible to check the system log? AIX is rejecting the authentication for some reason -- it will not even ask for a password. This suggests something about Mitogen's process environment is incorrect, and as a result, something like PAM is refusing to do business |
|
It is possible your missing 'become_flags' is causing the problem, but at least for now I doubt it. |
|
From googling "authentication is denied", it may relate to AIX RBAC authentication |
dw
added a commit
that referenced
this issue
Feb 9, 2019
dw
added a commit
that referenced
this issue
Feb 10, 2019
* origin/dmw: tests: add new compression parameter to mitogen_get_stack results tests: disable affinity_test on Travis :/ issue #508: fix responder stats test due to new smaller parent.py. issue #508: tests: skip minify_test Py2.4/2.5 for profiler.py. tests: fix fallout from 36fb318 issue #520: add AIX auth failure string to su. tests: move affinity_test to Ansible tests. core: cProfile is not available in 2.4. issue #505: docs: add new detail graph for one scenario. docs: update and re-record profile graphs in docs; closes #505 service: fix PushFileService exception tests: pad out localhost-* service: start pool shutdown on broker shutdown. master: .encode() needed for Py3. ansible: stash PID files in CWD if requested for debugging. issue #508: master: minify_safe_re must be bytes for Py3. bench: tidy up and cpu-pin some more files. tests: add localhost-x100 ansible: double the default pool size. ansible: raise error with correct exception type. issue #508: master: minify all Mitogen/ansible_mitogen sources. parent: PartialZlib docstrings. ansible: hacky parser to alow bools to be specified on command line parent: pre-cache bootstrap if possible. docs: update Changelog. ansible: add mitogen_ssh_compression variable. service: PushFileService never recorded a file as sent. parent: synchronize get_core_source() service: use correct profile aggregation name. SyntaxError. ansible: don't pin controller if <4 cores. tests: make soak testing work reliably on vanilla. docs: changelog tidyups. ansible: document and make affinity stuff portable to non-Linux ansible: fix affinity.py test failure on 2 cores. ansible: preheat PluginLoader caches before fork. tests: make mitogen_shutdown_all be run_once by default. docs: update Changelog. ansible: use Poller for WorkerProcess; closes #491. ansible: new multiplexer/workers configuration docs: update Changelog. docs: update Changelog. ansible: pin connection multiplexer to a single core utils: pad out reset_affinity() and integrate with detach_popen() utils: import reset_affinity() function. master: set Router.profiling if MITOGEN_PROFILING variable present. parent: don't kill children when profiling is active. ansible: hook strategy and worker processes into profiler profiler: import from linear2 branch core: tidy up existing profiling code and support MITOGEN_PROFILE_FMT issue #260: redundant if statement. ansible: ensure MuxProcess MITOGEN_PROFILING results reach disk. ansible/bench: make end= configurable. master: cache sent/forwarded module names
dw
added a commit
that referenced
this issue
Feb 10, 2019
* origin/master: (661 commits) Bump version for release. docs: update Changelog; closes #481 issue #481: core: preserve stderr TTY FD if one is present. issue #481: avoid crash if disconnect occurs during forward_modules() Add a few more important modules to preamble_size.py. .ci: add verbiage for run_batches() too. .ci: add README.md. docs: update thanks docs: lose "approaching stability" language, we're pretty good now docs: fix changelog syntax/order/"20KB" tests: add new compression parameter to mitogen_get_stack results tests: disable affinity_test on Travis :/ issue #508: fix responder stats test due to new smaller parent.py. issue #508: tests: skip minify_test Py2.4/2.5 for profiler.py. tests: fix fallout from 36fb318 issue #520: add AIX auth failure string to su. tests: move affinity_test to Ansible tests. core: cProfile is not available in 2.4. issue #505: docs: add new detail graph for one scenario. docs: update and re-record profile graphs in docs; closes #505 service: fix PushFileService exception tests: pad out localhost-* service: start pool shutdown on broker shutdown. master: .encode() needed for Py3. ansible: stash PID files in CWD if requested for debugging. issue #508: master: minify_safe_re must be bytes for Py3. bench: tidy up and cpu-pin some more files. tests: add localhost-x100 ansible: double the default pool size. ansible: raise error with correct exception type. issue #508: master: minify all Mitogen/ansible_mitogen sources. parent: PartialZlib docstrings. ansible: hacky parser to alow bools to be specified on command line parent: pre-cache bootstrap if possible. docs: update Changelog. ansible: add mitogen_ssh_compression variable. service: PushFileService never recorded a file as sent. parent: synchronize get_core_source() service: use correct profile aggregation name. SyntaxError. ansible: don't pin controller if <4 cores. tests: make soak testing work reliably on vanilla. docs: changelog tidyups. ansible: document and make affinity stuff portable to non-Linux ansible: fix affinity.py test failure on 2 cores. ansible: preheat PluginLoader caches before fork. tests: make mitogen_shutdown_all be run_once by default. docs: update Changelog. ansible: use Poller for WorkerProcess; closes #491. ansible: new multiplexer/workers configuration docs: update Changelog. docs: update Changelog. ansible: pin connection multiplexer to a single core utils: pad out reset_affinity() and integrate with detach_popen() utils: import reset_affinity() function. master: set Router.profiling if MITOGEN_PROFILING variable present. parent: don't kill children when profiling is active. ansible: hook strategy and worker processes into profiler profiler: import from linear2 branch core: tidy up existing profiling code and support MITOGEN_PROFILE_FMT issue #260: redundant if statement. ansible: ensure MuxProcess MITOGEN_PROFILING results reach disk. ansible/bench: make end= configurable. master: cache sent/forwarded module names Aggregate code coverage data across tox all runs Allow independant control of coverage erase and reporting Fix incorrect attempt to use coverage docs: update Changelog; closes #527. issue #527: catch new-style module tracebacks like vanilla. Fix DeprecationWarning in mitogen.utils.run_with_router() Generate coverage report even if some tests fail ci: fix incorrect partition/rpartition from 8a4caea issue #260: hide force-disconnect messages. issue #498: fix shutdown crash issue #260: avoid start_transmit()/on_transmit()/stop_transmit() core: ensure broker profiling output reaches disk master: keep is_stdlib_path() result as negative cache entry ci: Allow DISTROS="debian*32" variable, and KEEP=1 Use develop mode in tox issue #429: fix sudo regression. misc: rename to scripts. tab completion!! core: Latch._wake improvements issue #498: prevent crash on double 'disconnect' signal. issue #413: don't double-propagate DEL_ROUTE to parent. issue #498: wrap Router dict mutations in a lock issue #429: enable en_US locale to unbreak debops test. issue #499: fix another mind-numbingly stupid vanilla inconsistency issue #497: do our best to cope with crap upstream code ssh: fix test to match updated log format. issue #429: update Changelog. issue #429: update Changelog. issue #429: teach sudo about every know i18n password string. issue #429: install i18n-related bits in test images. ssh: tidy up logs and stream names. tests: ensure file is closed in connection_test. gcloud: small updates tests: give ansible/gcloud/ its own requirements file. issue #499: another totally moronic implementation difference issue #499: disable new test on vanilla. docs: update Changelog; closes #499. ...
dw
added a commit
that referenced
this issue
Feb 10, 2019
* origin/v024: (662 commits) docs: update Changelog release date. Bump version for release. docs: update Changelog; closes #481 issue #481: core: preserve stderr TTY FD if one is present. issue #481: avoid crash if disconnect occurs during forward_modules() Add a few more important modules to preamble_size.py. .ci: add verbiage for run_batches() too. .ci: add README.md. docs: update thanks docs: lose "approaching stability" language, we're pretty good now docs: fix changelog syntax/order/"20KB" tests: add new compression parameter to mitogen_get_stack results tests: disable affinity_test on Travis :/ issue #508: fix responder stats test due to new smaller parent.py. issue #508: tests: skip minify_test Py2.4/2.5 for profiler.py. tests: fix fallout from 36fb318 issue #520: add AIX auth failure string to su. tests: move affinity_test to Ansible tests. core: cProfile is not available in 2.4. issue #505: docs: add new detail graph for one scenario. docs: update and re-record profile graphs in docs; closes #505 service: fix PushFileService exception tests: pad out localhost-* service: start pool shutdown on broker shutdown. master: .encode() needed for Py3. ansible: stash PID files in CWD if requested for debugging. issue #508: master: minify_safe_re must be bytes for Py3. bench: tidy up and cpu-pin some more files. tests: add localhost-x100 ansible: double the default pool size. ansible: raise error with correct exception type. issue #508: master: minify all Mitogen/ansible_mitogen sources. parent: PartialZlib docstrings. ansible: hacky parser to alow bools to be specified on command line parent: pre-cache bootstrap if possible. docs: update Changelog. ansible: add mitogen_ssh_compression variable. service: PushFileService never recorded a file as sent. parent: synchronize get_core_source() service: use correct profile aggregation name. SyntaxError. ansible: don't pin controller if <4 cores. tests: make soak testing work reliably on vanilla. docs: changelog tidyups. ansible: document and make affinity stuff portable to non-Linux ansible: fix affinity.py test failure on 2 cores. ansible: preheat PluginLoader caches before fork. tests: make mitogen_shutdown_all be run_once by default. docs: update Changelog. ansible: use Poller for WorkerProcess; closes #491. ansible: new multiplexer/workers configuration docs: update Changelog. docs: update Changelog. ansible: pin connection multiplexer to a single core utils: pad out reset_affinity() and integrate with detach_popen() utils: import reset_affinity() function. master: set Router.profiling if MITOGEN_PROFILING variable present. parent: don't kill children when profiling is active. ansible: hook strategy and worker processes into profiler profiler: import from linear2 branch core: tidy up existing profiling code and support MITOGEN_PROFILE_FMT issue #260: redundant if statement. ansible: ensure MuxProcess MITOGEN_PROFILING results reach disk. ansible/bench: make end= configurable. master: cache sent/forwarded module names Aggregate code coverage data across tox all runs Allow independant control of coverage erase and reporting Fix incorrect attempt to use coverage docs: update Changelog; closes #527. issue #527: catch new-style module tracebacks like vanilla. Fix DeprecationWarning in mitogen.utils.run_with_router() Generate coverage report even if some tests fail ci: fix incorrect partition/rpartition from 8a4caea issue #260: hide force-disconnect messages. issue #498: fix shutdown crash issue #260: avoid start_transmit()/on_transmit()/stop_transmit() core: ensure broker profiling output reaches disk master: keep is_stdlib_path() result as negative cache entry ci: Allow DISTROS="debian*32" variable, and KEEP=1 Use develop mode in tox issue #429: fix sudo regression. misc: rename to scripts. tab completion!! core: Latch._wake improvements issue #498: prevent crash on double 'disconnect' signal. issue #413: don't double-propagate DEL_ROUTE to parent. issue #498: wrap Router dict mutations in a lock issue #429: enable en_US locale to unbreak debops test. issue #499: fix another mind-numbingly stupid vanilla inconsistency issue #497: do our best to cope with crap upstream code ssh: fix test to match updated log format. issue #429: update Changelog. issue #429: update Changelog. issue #429: teach sudo about every know i18n password string. issue #429: install i18n-related bits in test images. ssh: tidy up logs and stream names. tests: ensure file is closed in connection_test. gcloud: small updates tests: give ansible/gcloud/ its own requirements file. issue #499: another totally moronic implementation difference issue #499: disable new test on vanilla. ...
|
I tried to execute
I'll try to reproduce it on rhel7 |
|
If it works when you are logged in interactively, then it must be some problem with how Mitogen creates processes or TTYs, or perhaps because Mitogen launches a non-interactive SSH session, it does not receive some important privilege. I'm afraid I do not know enough about AIX to understand this issue :) Do you know of an expert within your organization that would understand deeper security issues? I am fairly sure this is some strange security restriction AIX has, and to make things work, we must meet those restriction. |
|
Hi man! Guess what?) I reproduced the issue on rhel7. It has a different output in same situation but I can fix it by the same way to replace 'become: yes' statement. Logs from node And output from host: |
PatrickCoakley23
pushed a commit
to cyara/mitogen
that referenced
this issue
Nov 10, 2023
…-fastrack 16439-remove fromuser to support multi cli
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hello. I guess i found a bag using a privilege escalation in an ansible playbook. I reduced the playbook to describe a behavior.
When I play it I get an error in task "command: "whoami""
error occurred on host DB2TST_N1.vdatacenter.it.ru: EOF on stream; last 300 bytes received: u'3004-501 Cannot su to "db2inst1" : Authentication is denied.\n'The second task completes normally.
Logs from target:
TASK aix_db2.txt
Ok, I solve the problem replacing "become: yes" to task
In this way all works fine. But in real project I have many huge playbooks which 99% consist of task needs "become: yes". And only 1% tasks needs constructions like this
become_user: "db2inst1" become_method: "su" become_flags: "-"The text was updated successfully, but these errors were encountered: