| Author |
Topic |
|
oitsubob
Yak Posting Veteran
70 Posts |
 Posted - 2005-01-27 : 20:14:49
|
| Hey All!I'm trying to figure out a way use RCMD from xp_cmdshell to execute code on a remote server. From what I've read [1], it can't be done. Although the article was published in 1999, you'd think MS would have come up with a fix for it by now. Anyone seen a version of RCMD without the restriction?[1] http://www.windowsitpro.com/Article/ArticleID/14290/14290.htmlThanks,Bob |
|
|
tkizer
Almighty SQL Goddess
38200 Posts |
Posted - 2005-01-27 : 20:18:10
|
| Does RCMD require a user to type or click anything? If so, then that's why it doesn't work. xp_cmdshell does not run in the same context of the user that is issuing the command. So the user will never get prompted to do anything.Tara |
 |
|
|
oitsubob
Yak Posting Veteran
70 Posts |
Posted - 2005-01-27 : 20:23:37
|
| Tara,No, it doesn't require the user to click or type anything. Upon issuing the command from the command prompt, it just works. Frustrating...Thanks,Bob |
|
|
|
robvolk
Most Valuable Yak
15732 Posts |
Posted - 2005-01-27 : 20:51:29
|
I wouldn't necessarily call this a "restriction", allowing this kind of remote command execution is pretty dangerous from a security perspective. xp_cmdshell is dangerous enough sometimes, you can blow up a server with it. RCMD could allow you to blow up an entire network.Plus, there's nothing to stop you from remotely calling xp_cmdshell via linked servers. You can execute it using the 4-part naming convention:EXEC remoteserver.master.dbo.xp_cmdshell 'format c:'Man, I hope some newbie actually runs that.  I could use a good laugh. |
|
|
|
AndyB13
Aged Yak Warrior
583 Posts |
Posted - 2005-01-28 : 09:14:39
|
Ooops!!!!!!  |
|
|
|
oitsubob
Yak Posting Veteran
70 Posts |
Posted - 2005-01-28 : 11:52:29
|
| Well, yeah I suppose one could wreak havoc on other servers if their SQL account had rights to run xp_cmdshell and the account SQL ran as had rights on the remote servers to execute code. I guess it comes down to administrators locking down their servers and restricting access appropriately.Now I really need to remotely execute code. Does anyone have any other suggestions? I've even tried writing out a batch file containing the command string and then tried to calling it, but still no luck -- same error.Thanks,Bob |
|
|
|
tkizer
Almighty SQL Goddess
38200 Posts |
Posted - 2005-01-28 : 11:55:05
|
| Did you see Rob's post about using linked servers to execute remote code?Tara |
|
|
|
oitsubob
Yak Posting Veteran
70 Posts |
Posted - 2005-01-28 : 12:09:02
|
| Tara,Thanks, I did. Unfortunately, the machine in question isn't a SQL server. To give you a little more information, I have a web based application where users make various selections in a form that translate to switches and parameters for the application on the remote server.Bob |
|
|
|
tkizer
Almighty SQL Goddess
38200 Posts |
Posted - 2005-01-28 : 12:16:53
|
| So why doesn't the web based application make the remote call to another server rather than putting this inside SQL Server?Tara |
|
|
|
oitsubob
Yak Posting Veteran
70 Posts |
Posted - 2005-01-28 : 12:43:38
|
| I probably could, but I'm logging the transactions in our database and figured while I'm there I'd make the call as well.Bob |
|
|
|
MichaelP
Jedi Yak
2489 Posts |
Posted - 2005-01-28 : 13:28:58
|
| Maybe this is a security thing? The user that SQL server is running as can't run the command?Michael<Yoda>Use the Search page you must. Find the answer you will.</Yoda> |
|
|
|
oitsubob
Yak Posting Veteran
70 Posts |
Posted - 2005-01-28 : 17:13:30
|
| Nah, security isn't the problem. Yesterday I tried logging into the console as the account SQL runs as and executed the statement from the command prompt with no problems whatsoever. The article I referenced above describes the problem as "...the way that RCMD in the NT resource kit is coded - it is probably expecting there to be a keyboard/mouse defined in the user context, which there isn't.". I even tried running the statement from QA while logged in as the account SQL runs as and still no luck. Haven't had any luck finding a replacement version of rcmd.exe, but I did find something called REXEC [1], but it doesn't seem to work under Windows 2000.[1] http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/rexec.mspxI appreciate everyone taking the time to respond. If you think of any other way to do this, let me know.Bob |
|
|
|
TimS
Posting Yak Master
198 Posts |
|
|
oitsubob
Yak Posting Veteran
70 Posts |
Posted - 2005-01-28 : 18:42:01
|
| Thanks Tim! I'll check it out...Bob |
|
|
|
robvolk
Most Valuable Yak
15732 Posts |
Posted - 2005-01-28 : 23:10:57
|
quote:
I probably could, but I'm logging the transactions in our database and figured while I'm there I'd make the call as well.
How about having the web app log the transactions to a text file, and then run the remote code? The database would only have to import data from that log file, and erase or empty it when it's done. This can be done on a schedule to keep your logs up to date. The database does not have to interact with the application at all, it just loads whatever data happens to be in that file and then clears it out. |
|
|
|
oitsubob
Yak Posting Veteran
70 Posts |
Posted - 2005-01-29 : 03:21:17
|
| I've considered something along those lines and will probably end up going that route. I just like running code like this through the db server since it's easy to call, it's maintained in once place and seems to run smoother. Our production web environment runs multiple servers, round-robin style, and any text logs have to be merged, sorted and imported. It's often messy and I try not to go there unless I have to. I don't necessarily have to write a text log, but it is pretty clear at this point that I'm going to have to call the remote executeable from the web application.Thanks everyone for their help. I'll follow-up next week to let you know whether or not I got it working.Have a great weekend!Bob |
|
|
|
|
xp_cmdshell and RCMD