Giving interact with desktop permission to cyg_server

Giving interact with desktop permission to cyg_server

[Andrew DeFaria]

I've set up ssh on some Windows 2003 and 2008 servers. These servers are 
intended to be used to build software and the like driven by using 
Cygwin's OpenSSH. Largely it works well, however...

One process that fails is a Perl process that opens an Excel spreadsheet 
using OLE. Note that it does not actually open a window or at least not 
a visible window, but rather it reads data out of the Excel spreadsheet. 
Excel does run in the background.

So, when we ssh into one of these servers and attempt to run this Perl 
process the open of the Excel spreadsheet fails. I suspect the problem 
is that even though it doesn't show an open window it does interact with 
the desktop (seems dumb to me). So I'd like to bestow interact with 
desktop right to the sshd service. You can do that if you use a Local 
System account but Cygwin requires the setting up of another user, 
cyg_server, to have sshd run as in order for ssh to work properly. How 
then do I bestow on the cyg_server user the right to interact with the 
desktop?

I see this - http://sourceware.org/ml/cygwin/2010-04/msg00728.html - in 
which Larry says "MS removed that feature in Vista so...". Does this 
mean I'm hosed? There still seems to be an Interact with Desktop toggle 
for Local System...
-- 
Andrew DeFaria <http://defaria.com>
One of the great tragedies of life is the murder of a beautiful theory 
by a gang of brutal facts. - Benjamin Franklin


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Giving interact with desktop permission to cyg_server

[Corinna Vinschen]

On Mar 28 19:02, Andrew DeFaria wrote:
> I've set up ssh on some Windows 2003 and 2008 servers. These servers
> are intended to be used to build software and the like driven by
> using Cygwin's OpenSSH. Largely it works well, however...
> 
> One process that fails is a Perl process that opens an Excel
> spreadsheet using OLE. Note that it does not actually open a window
> or at least not a visible window, but rather it reads data out of
> the Excel spreadsheet. Excel does run in the background.
> 
> So, when we ssh into one of these servers and attempt to run this
> Perl process the open of the Excel spreadsheet fails. I suspect the
> problem is that even though it doesn't show an open window it does
> interact with the desktop (seems dumb to me). So I'd like to bestow
> interact with desktop right to the sshd service. You can do that if
> you use a Local System account but Cygwin requires the setting up of
> another user, cyg_server, to have sshd run as in order for ssh to
> work properly. How then do I bestow on the cyg_server user the right
> to interact with the desktop?
> 
> I see this - http://sourceware.org/ml/cygwin/2010-04/msg00728.html -
> in which Larry says "MS removed that feature in Vista so...". Does
> this mean I'm hosed? There still seems to be an Interact with
> Desktop toggle for Local System...

For some mystical reason, Microsoft didn't remove this checkbox, but
other than that, yes, you're hosed starting with Vista/2008.

The workaround suggested in all Microsoft docs is to split the job
into two processes, one started as service, the other started on
the local desktop, and then to control the desktop process from the
service process via some means of IPC.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Giving interact with desktop permission to cyg_server

[Andrew DeFaria]

On 03/29/2012 01:06 AM, Corinna Vinschen wrote:
> For some mystical reason, Microsoft didn't remove this checkbox, but 
> other than that, yes, you're hosed starting with Vista/2008.
Well that sucks! I'm stuck because I wish to remotely execute a script 
which uses a program (Excel) to get data and does not really display a 
window because as of 2008 I cannot bestow a right (interact with 
desktop) to a service that really shouldn't need that right! Thanks MS!

I believe I read somewhere that MS believes this to be some sort of 
security hole but they should recognize that in some more controlled 
situations like being in the intranet operating on servers that probably 
don't even have displays where this should be allowed.

I guess that checkbox then doesn't do anything. I wonder if anybody has 
ever reported it...
> The workaround suggested in all Microsoft docs is to split the job 
> into two processes, one started as service, the other started on the 
> local desktop, and then to control the desktop process from the 
> service process via some means of IPC. 
Yes but how can this be done in the context of the service being 
Cygwin's ssh and the desire being to simply run build scripts, some of 
which read Excel files???

Oh well, thanks for the answer, Corinna, even though the news is not 
good. Now to attempt to deal with this problem with asking the question 
of the developers "Could you use some other form of input than an Excel 
spreadsheet! - geeze!" ;-)
-- 
Andrew DeFaria <http://defaria.com>
Don't you hate when your hand falls asleep and you know it will be up 
all night.


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Giving interact with desktop permission to cyg_server

[Corinna Vinschen]

On Mar 29 07:25, Andrew DeFaria wrote:
> On 03/29/2012 01:06 AM, Corinna Vinschen wrote:
> >For some mystical reason, Microsoft didn't remove this checkbox,
> >but other than that, yes, you're hosed starting with Vista/2008.
> Well that sucks! I'm stuck because I wish to remotely execute a
> script which uses a program (Excel) to get data and does not really
> display a window because as of 2008 I cannot bestow a right
> (interact with desktop) to a service that really shouldn't need that
> right! Thanks MS!
> 
> I believe I read somewhere that MS believes this to be some sort of
> security hole but they should recognize that in some more controlled
> situations like being in the intranet operating on servers that
> probably don't even have displays where this should be allowed.
> 
> I guess that checkbox then doesn't do anything. I wonder if anybody
> has ever reported it...

Vista is 4 years old, so you have one guess...

> >The workaround suggested in all Microsoft docs is to split the job
> >into two processes, one started as service, the other started on
> >the local desktop, and then to control the desktop process from
> >the service process via some means of IPC.
> Yes but how can this be done in the context of the service being
> Cygwin's ssh and the desire being to simply run build scripts, some
> of which read Excel files???
> 
> Oh well, thanks for the answer, Corinna, even though the news is not
> good. Now to attempt to deal with this problem with asking the
> question of the developers "Could you use some other form of input
> than an Excel spreadsheet! - geeze!" ;-)

CSV files?


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Giving interact with desktop permission to cyg_server

[Earnie Boyd]

On Thu, Mar 29, 2012 at 10:39 AM, Corinna Vinschen wrote:
> On Mar 29 07:25, Andrew DeFaria wrote:
>>
>> Oh well, thanks for the answer, Corinna, even though the news is not
>> good. Now to attempt to deal with this problem with asking the
>> question of the developers "Could you use some other form of input
>> than an Excel spreadsheet! - geeze!" ;-)
>
> CSV files?

Or XML, modern Excel produces both.

-- 
Earnie
-- https://sites.google.com/site/earnieboyd

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Giving interact with desktop permission to cyg_server

[Csaba Raduly]

On Fri, Mar 30, 2012 at 1:31 PM, Earnie Boyd  wrote:
> On Thu, Mar 29, 2012 at 10:39 AM, Corinna Vinschen wrote:
>> On Mar 29 07:25, Andrew DeFaria wrote:
>>>
>>> Oh well, thanks for the answer, Corinna, even though the news is not
>>> good. Now to attempt to deal with this problem with asking the
>>> question of the developers "Could you use some other form of input
>>> than an Excel spreadsheet! - geeze!" ;-)
>>
>> CSV files?
>
> Or XML, modern Excel produces both.

I wouldn't want to touch the XML (or HTML) generated by any MSOffice
program with a 10-foot pole. It's hideous.

Csaba
-- 
GCS a+ e++ d- C++ ULS$ L+$ !E- W++ P+++$ w++$ tv+ b++ DI D++ 5++
The Tao of math: The numbers you can count are not the real numbers.
Life is complex, with real and imaginary parts.
"Ok, it boots. Which means it must be bug-free and perfect. " -- Linus Torvalds
"People disagree with me. I just ignore them." -- Linus Torvalds

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Giving interact with desktop permission to cyg_server

[Andrew DeFaria]

On 03/30/2012 04:31 AM, Earnie Boyd wrote:
> On Thu, Mar 29, 2012 at 10:39 AM, Corinna Vinschen wrote:
>> On Mar 29 07:25, Andrew DeFaria wrote:
>>> Oh well, thanks for the answer, Corinna, even though the news is not
>>> good. Now to attempt to deal with this problem with asking the
>>> question of the developers "Could you use some other form of input
>>> than an Excel spreadsheet! - geeze!" ;-)
>> CSV files?
> Or XML, modern Excel produces both.
>
I've asked about the need to use a spreadsheet and it seems the 
spreadsheet is used for both input and output of the script. The 
spreadsheet is read as input and then annotated and updated and given 
back. Personally I think the whole thing should be re-written as a web 
app...
-- 
Andrew DeFaria <http://defaria.com>
Can fat people go skinny-dipping?


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Giving interact with desktop permission to cyg_server

[Earnie Boyd]

On Fri, Mar 30, 2012 at 10:11 AM, Andrew DeFaria wrote:
> On 03/30/2012 04:31 AM, Earnie Boyd wrote:
>>
>> On Thu, Mar 29, 2012 at 10:39 AM, Corinna Vinschen wrote:
>>>
>>> On Mar 29 07:25, Andrew DeFaria wrote:
>>>>
>>>> Oh well, thanks for the answer, Corinna, even though the news is not
>>>> good. Now to attempt to deal with this problem with asking the
>>>> question of the developers "Could you use some other form of input
>>>> than an Excel spreadsheet! - geeze!" ;-)
>>>
>>> CSV files?
>>
>> Or XML, modern Excel produces both.
>>
> I've asked about the need to use a spreadsheet and it seems the spreadsheet
> is used for both input and output of the script. The spreadsheet is read as
> input and then annotated and updated and given back. Personally I think the
> whole thing should be re-written as a web app...

The users wanting it their way is what keeps us employed doing
development work.  Otherwise we would have stopped developing a long
time ago because everyone would live with just the way it works now.
:D  We're still developing in VBA scripting producing excel reports
connecting directly to the DB from excel.

-- 
Earnie
-- https://sites.google.com/site/earnieboyd

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Giving interact with desktop permission to cyg_server

[Andrew DeFaria]

On 3/30/2012 12:10 PM, Earnie Boyd wrote:
>> I've asked about the need to use a spreadsheet and it seems the spreadsheet
>> is used for both input and output of the script. The spreadsheet is read as
>> input and then annotated and updated and given back. Personally I think the
>> whole thing should be re-written as a web app...
> The users wanting it their way is what keeps us employed doing
> development work.  Otherwise we would have stopped developing a long
> time ago because everyone would live with just the way it works now.
> :D  We're still developing in VBA scripting producing excel reports
> connecting directly to the DB from excel.
Just because a user wants it one way does not necessarily mean that that 
way is a good way or that other better ways do not exist. The difference 
between a developer and a consultant is that the developer will simply 
implement the solution as requested. The consultant may advise a 
different way to solve the problem that in the long term is more 
efficient, flexible or scalable. While the former gets the instant task 
accomplished, the later is the longer term view and many times can make 
future request much easier to satisfy.

I prefer the longer term view. ;-)

Also, if I never had to look at or code Visual <anything> I would be a 
much happier guy...
-- 
Andrew DeFaria <http://defaria.com>
Be nice to your kids. They'll choose your nursing home.


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple