-
Notifications
You must be signed in to change notification settings - Fork 767
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Regression in v9.8.0.0p1+: "Access is denied" 0x5 occurred while reading the console Error output buffer causes ansible win_copy task to fail #2296
Comments
@jantari can you please include some repro steps? I am not familiar with ansible and wondering if there is a way to repro this without it. |
I will attempt a repro without ansible but it might take me a few days as I'm really busy atm. The production impact of this was really in the context of ansible, but we've downgraded to SSH v9.5 as a workaround so that's working again. |
@jantari I've had a play around today to see what the actual underlying cause is here. Here is what I've found when it comes to Ansible
It looks like this error happens when the last statement run in PowerShell was a native executable. It's failing to read the console output for transcription causing PowerShell to throw an exception which sets A nice and quick way to replicate this error outside of Ansible is to setup the group policy that enables transcripts in PowerShell. Once done run the following ssh user@win-host powershell.exe -Command whoami An example from my test host is
We can
Looking into the stacktrace we can see that We can also see that The So essentially PowerShell is calling ReadConsoleOutput after the process has finished with I've also tested out PowerShell 7 and while it doesn't affect it, the issue is still there. That is because We can verify that it fails by using reflection to check
Why the issue appears with the newer SSH version I'm not sure but looking at the process tree differences shows that 9.8 uses some new |
I've had another look at this today and I think microsoft/terminal#5468 is the reason for the access error. We can see that in the new process heirarchy the This makes sense as you don't want the less privileged process the ability to scrap the console buffer also used by a more privileged process. You can also see that an interactive ssh session shows that there is a conhost spawned as the user for the spawned shell and that does not have the access denied issue trying to read the console buffer I'm unsure how to fix this but it seems like either;
|
Thanks for your analysis @jborean93, I can confirm that the issue is easily reproducible outside of ansible with PowerShell transcriptions enabled and then running the command you suggested:
and ofc adding
|
Having the same problem here. Seems to happen on non-interactive sessions only. Logging in personally as the same user with the same key and executing the same command as our script doesn't result in an error. |
Prerequisites
Steps to reproduce
I am experiencing a problem when attempting to run a simple
ansible.windows.win_copy
task against a Windows Server 2022 VM that's running Win32-OpenSSH 9.8.0.0 or 9.8.1.0 (the latest two releases). PowerShell transcription is enabled via GPO.The exact same task works fine against the exact same VM when I install Win32-OpenSSH 9.5.0.0 instead.
The newer versions of OpenSSH seem to produce an unexpected error which leads to an exit code of 1 from the powershell.exe process on the remote machine, thus reporting back as a failed task in ansible. The full
-vvv
debug output from ansible shows the errors that are printed.Expected behavior
Actual behavior
Error details
The verbose output above should contain all error details.
Environment data
Windows Server 2022 Datacenter (No Desktop Experience)
Version
9.8.1.0
Visuals
No response
The text was updated successfully, but these errors were encountered: