How it works is, I have a web form that I fill out and when I click Submit, it runs the .pl script and calls the .pm file which contains the dnscmd lines.
...when I take one of the lines of my script and run it from an elevated command line, it works and adds the entries
I could be wrong, but I believe the statements of yours listed above point to a permissions issue.
With the first statement, it sounds like you're running this as a script via a web server. Most web servers are running server side scripts with a restricted user account. Probably the web server's user account for responding to web requests does not have permissions to run the dnscmd.exe utility.
Even if you were to make that web server user account a member of the administrator user group (which I don't recommend you doing), your second statement points to another issue. Even with administrator level rights, you're having to use a command prompt with elevated permissions (i.e. a command prompt opened with "Run as Administrator"). Off hand, I'm not sure of how to accomplish this. This sounds a lot like the issue in someone else's recent post (Cannot execute external process).
Don't necessarily have answers for you, but thought this might help point you in the right direction.
| [reply] |
Well, first thing that caught my eye is that "ExecAndReturn" function. You don't show the code, but it sounds like an oxymoron, since exec doesn't return by definition.
If you haven't already, you should try running that command as the user that your webserver is using to clinch the issue. If you really do have to be admin to do it, then your problem is clear.
| [reply]
[d/l] |
System Error Codes? I guessed, OK.:-(
Regards, Karl
«The Crux of the Biscuit is the Apostrophe»
| [reply] |
I guess again:
When you invoke dnscmd [params] that means you really say cmd.exe dnscmd [params], as fare as i remember. Perhaps the user that your webserver is using has not the permissions to run cmd.exe? A System Policy or whatever this is called? I blandly remember that invoking cmd.exe must explicitly be allowed for the IIS UID...
Best regards, Karl
Edit: added missing word
«The Crux of the Biscuit is the Apostrophe»
| [reply]
[d/l]
[select] |
Thanks to everyone for all of the tips and information. I have tried everything you have suggested and it still will not work. I'm extremely frustrated at this point. I have been working on this for weeks and nothing I do works. It's aggravating because it works perfectly on my Windows 2003 server. I just can't use it over there because my DNS server is now on a remote 2008 server. I'm lost for a solution and it's driving me nuts.
| [reply] |
I'm not a windows guy, so what I say here may be nonsense, but…
It might actually be a Good Thing™ that the 2008 server has better security than the 2003 model. The fact that it gets in the way of doing what you need to do is sad, but it might be even sadder if, by allowing needful things to be easier for you, it also allowed bad things to be easier for bad people.
If the "web-server-userid" vs. "admin-user-id" conflict is the problem, I wonder if there might be a way to run a daemon process on the 2008 server (under the admin account) that, say, monitors a directory, and if anything gets placed in that directory, it reads it as a set of dnscmd instructions and runs them.
If you promise to be very careful about setting up that directory, and configuring the web-server process that could place files into that directory, then you might be able to do what needs to be done without completely defeating the "enhanced security" of the 2008 system.
(Update: you would of course also need to be very careful about setting up the admin daemon process - basically, you want to make sure that both processes are very rigorously scrupulous about what can be placed into that directory and what kinds of actions can be taken as a result. Every conceivable safeguard is needed, and the lingering problem is the set of exploits that someone else could conceive before you do.)
Again, I'm not a windows guy - and I'm quite poorly informed about DNS security issues in general. Please keep looking for advice from a "higher authority." (Not just perl hackers, but also real sysadmins with windows 2008 experience.)
| [reply] |
Don't give up. See this.
Karl
«The Crux of the Biscuit is the Apostrophe»
| [reply] |