Repository navigation
Keep Herdr reachable when Windows elevation is involved - #68
Merged
Merged
Conversation
From Herdr 0.9.4 a Windows server started as administrator admits only administrator clients. A connector that is not elevated then got a bare "connect EPERM \\.\pipe\..." in the browser, which names neither the cause nor the fix. Access denied on the pipe now comes back as herdr_elevated, and the message says to start Herdr from an ordinary terminal or to set allow_unelevated_clients under [server] in Herdr's config.
From Herdr 0.9.4 a Windows server started as administrator admits only administrator clients. herdr-remote runs as administrator under its keep-alive Windows service, so a Herdr it started there turned the user's own terminal away, although the server is meant to be theirs. When its token has High or System integrity and Herdr is 0.9.4 or later, it now starts `herdr server --allow-unelevated-clients`, which admits them as every earlier Herdr did. An older or unreadable Herdr gets no flag, since one that does not know it would refuse to start.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
From Herdr 0.9.4 a Windows server started as administrator admits only administrator clients.
herdr_elevatedwith a message that says how to fix it (ordinary terminal, or[server] allow_unelevated_clients = true), instead of a bareconnect EPERM.--allow-unelevated-clients, so the user's own terminal is not locked out — the behaviour of every earlier Herdr.Not exercised on a real Windows machine; covered by unit tests with injected
whoamioutput and connect errors.