topic Re: Python Extension 2.0 - Using LocalSystem user in Extensions

Python Extension 2.0 - Using LocalSystem user

Benji_Dynatrace — Tue, 14 May 2024 07:12:12 GMT

Hi,

this is pretty self explanatory, we are trying to build extensions that can do things with admin rights (like running certain powershell scripts for example) but we noticed that the python environment run on the LocalService account which doesn't have admin rights. So our question is this, is there a way to deploy the python environment so that it runs on LocalSystem instead of LocalService?

Thanks!

Re: Python Extension 2.0 - Using LocalSystem user

Mike_L — Mon, 13 May 2024 20:59:10 GMT

There is not. The way we work around this is by asking for a username and password and running the commands as that user.

Please raise a product idea if that is insufficient for you.

Re: Python Extension 2.0 - Using LocalSystem user

Benji_Dynatrace — Thu, 23 May 2024 20:15:46 GMT

Hi Mike,

are there any examples on how to implement the execution using given usernames and passwords, we haven't been able to replicate it on our end.

Thanks

Re: Python Extension 2.0 - Using LocalSystem user

Mike_L — Thu, 23 May 2024 21:49:18 GMT

You can grab either the extended activedirectory extension or the Citrix extension from the hub. They have implemented that functionality.

Re: Python Extension 2.0 - Using LocalSystem user

jonhaugen — Tue, 25 Jun 2024 14:35:59 GMT

Hi Michael,

Can you please elaborate on some of the thoughts behind this decision? Every other Oneagent process is running as NT AUTHORITY\SYSTEM including the old extension process.

There are a few extensions where you need to run as SYSTEM such as when querying a database or listing any IIS related properties. This is even visible in the new IIS Extension available through the Hub where App pools and sites is listed with metrics through WMI, but no relationships between each other.

Thank you very much in advance!

EDIT:
Added Product Idea: https://community.dynatrace.com/t5/Product-ideas/Python-Extension-2-0-run-as-NT-AUTHORITY-SYSTEM/idi-p/249130#M45958

Re: Python Extension 2.0 - Using LocalSystem user

Mike_L — Tue, 25 Jun 2024 15:42:22 GMT

It was a requirement from our security department. As extension framework 2.0 distributes code, it was important that the code does not run as a privileged user. We were looking into a way to opt out of the more secure method, your product idea will help put that onto the radar again.