Jenkins user gets "Permission denied" at deploying - jenkins

Deploying a PDF documentation Jenkins executes a simple batch file:
#echo off
REM
REM Adapt the filepath as needed
REM
set PDF_OUTPUT_DIR="F:\svnWorkingCopy\kostra\trunk\DITA\__out_pdf"
set PDF_DEPLOY_DIR="\\FILE-SRV01\Austausch\Setup_Masterbuild\KOSTRA_AKVS\Deutsch\KostraAKVS"
del %PDF_DEPLOY_DIR%\KostraUserManual.pdf /F /Q
copy %PDF_OUTPUT_DIR%\kostra.pdf %PDF_DEPLOY_DIR%\KostraUserManual.pdf /Y
It quits with permission denied. End of console output (in German) is:
[kostra] $ cmd /c call C:\Windows\TEMP\jenkins1093559218605334188.bat
F:\svnWorkingCopy\kostra>F:\svnWorkingCopy\kostra\trunk\DITA\kostra-pdf-deploy.bat
Zugriff verweigert
0 Datei(en) kopiert.
Build step 'Windows Batch-Datei ausführen' marked build as failure
Archiviere Artefakte
Discard old builds...
#111 is removed because old than numToKeep
Sending e-mails to: fjk#akgsoftware.de
Finished: FAILURE
The Jenkins user is the user logged on that machine (Win Server 2012 r2) and has all Jenkins rights.
If I open CMD and execute the batch file manually, everything goes OK. Any idea why Jenkins refuses to copy the file? Is there a way to get a more detailed error msg. from Jenkins?

I see you are running Jenkins on windows. First check that if the user that started Jenkins is allowed to write on your directory. If that is not the case restart Jenkins with a user allowed to write in that directory.

Found the solution for my environment (Jenkins as Windows Service):
The default system user assigned to the Jenkins service must be changed to the logged on windows user.
Even after doing so Jenkins as a service doesn't know about mapped network drives, so you must change these to UNC paths if you have to deploy to a local network share.

Related

I changed the JENKINS_USER=root but it is still jenkins in ubuntu

I used "apt install jenkins" installed jenkins and it is started successful. but when it build a item it throw a error as below:
+ whoami
jenkins
+ supervisorctl restart Zonr.RuifWu.WebApi
error: <class 'PermissionError'>, [Errno 13] Permission denied: file: /usr/lib/python3/dist-packages/supervisor/xmlrpc.py line: 560
Build step 'Execute shell' marked build as failure
Finished: FAILURE
So I vi /etc/defualt/jenkins and modify the config
#JENKINS_USER=$NAME
#JENKINS_USER=$NAME
JENKINS_USER=root
JENKINS_GROUP=root
I execute the command "systemctl restart jenkins" and build the item again, it still show the error message as same as above. the current operaion user is still jenkins not root.
I modify the config file and input some error code intentionally, and the jenkins can be restart successfuly! this is my config file(the ,,,,, and ---- is just for test):
# pulled in from the init script; makes things easier.
NAME=jenkins
# arguments to pass to java
# Allow graphs etc. to work even when an X server is present
JAVA_ARGS="-Djava.awt.headless=true"
#JAVA_ARGS="-Xmx256m"
# make jenkins listen on IPv4 address
#JAVA_ARGS="-Djava.net.preferIPv4Stack=true"
PIDFILE=/var/run/$NAME/$NAME.pid
# user and group to be invoked as (default to jenkins)
#JENKINS_USER=$NAME
#JENKINS_USER=$NAME
JENKINS_USER=root
JENKINS_GROUP=root
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
------------------------------------------------------------
# location of the jenkins war file
JENKINS_WAR=/usr/share/java/$NAME.war
# jenkins home location
JENKINS_HOME=/var/lib/$NAME
My jenkins version is 2.346.2. so my question is:
how can I use jenkins user to run "supservisorctl restart xxxxx"? I preferd jenkins user rather than root.
Is this "/etc/defualt/jenkins" the jenkins config file? how to change running user to root?
Could anyone help me please? Thank you very much!
I have found the config here: /usr/lib/systemd/system/jenkins.service
I changed User=root Group=root and then systemctl restart jenkins.
It works well!

access denied on a jenkins build to a remote windows file server

I'm new to Jenkins and I am trying to play around with it.
I'm trying to run a pipeline with a command that will run a simple dir on a remote windows fileserver (with a UNC path provided).
pipeline {
agent any
stages {
stage('Read File') {
steps {
bat 'whoami'
bat label: 'check directory', script: 'dir \\\\filesrv\\C$\\NewUser'
}
}
}
}
The whoami command returns the Jenkins AD user i configured to run the service on the slave
but after that I get an error Access is denied.
I tried giving the Jenkins AD service user local admin permission on the Jenkins master and slave servers and also on the file server. didn't help.
I also tried to explicitly giving that user full control permission on the folder I'm trying to access (located on the file server). didn't help.
I also tried giving permission to the computer accounts like many thread suggenst and point to this link https://serverfault.com/questions/135867/how-to-grant-network-access-to-localsystem-account also didn't help.
Will appreciate some assistance in understanding what permission is it missing?
Thanks in advance
i'll post the solution for any feature reference for those who are using windows environment...
the thing i was missing was making the target folder a shared folder.
so instead of \\\\filesrv\\C$\\NewUser' the path that worked is \\\\filesrv\\NewUser'
where NewUser is the name of the share

Access is denied prompted while windows sc command calling from jenkins groovy

I am trying to create CI/CD pipeline using jenkins and my environment devops/deployment is windows servers 2016.
Pipeline script written in apache groovy. Which call batch file for deploy the code, that batch script is doing 2 tasks.
deploy code on another host machine (using robocopy command)
start w3svc service (using sc command).
Both command are mentioned in batch file which is call through groovy script with simple 'bat batchfilelocation /name.bat'. here is batch script:
#echo [off]
net use "\\<servername>\<shareddirectory>" <password> /user:<domain\user> /persistent:no
robocopy "C:\jenkins\AngularPipeline\dist\<project>" \\$<Dir>eddistinationServer>\<shar /E /PURGE
sc \\$servername start w3svc
echo on
echo close batch script!
For sc command execuation it is giving below error:
C:\jenkins\AngularPipeline>sc \ start w3svc [SC]
StartService: OpenService FAILED 5:
Access is denied.
This script is working well while I directly called it through command prompt(non administrator). access denied only comes while this script run under the jenkins groovy.
I have checked below possibilities :
WMI permission on source and target machine
//Confirm that WinRM is properly configured. c:>Winrm quickconfig
//Make sure that the remote server allows commands from any machine. PS c:>Set-item wsman:localhost\client\trustedhosts -value *
Restart Windows Remote management service restarted on both machines
C:\Windows\system32>sc \ sdshow w3svc
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Please suggest how to resolve the same.
Recommended Approach:
If you are not running this Jenkins job on an another agent then you could re-configure your Jenkins service to use local administrator account. To do so follow below steps
Open Start Menu
Search 'Services'
Find "Jenkins" service
Right click on Jenkins service
Open Properties
Click on "Log on" tab
Select "This Account"
Browse for local system admin account and select it
Add Password and confirm password for same id
click OK
Restart/Start Jenkins Service
Second Approach:
Create a bat file on the server/workstation where Jenkins is installed
Create a shortcut of the file
Right click on Shortcut and go to 'properties'
Click on 'Comp'
check the check box next to "Run as administrator"
Click OK and Then
Click Apply Now, Go to Control Panel -> System and Security ->
Action Center -> Change User Account Control Settings
Set the level to "never notify" Run that bat shortcut using Jenkins job
In this case the job will marked as failed but the script will get executed.

how I can change permission for a folder in jenkins?

I have jenkins working in local server on my mac and for a job, I need to run a script shell witch it need to read a json file. I tryied to put it in workflow-lib file. But when I run the job for testing, the script return an error witch says :
/Users/****/.jenkins/workflow-libs/testCollections: Permission denied
Build step 'Run a shell script' marked build as failure
Finished: FAILURE
So I know that the script can read the json file but I don't know how I can give it this permission.
thank you for helping
Please follow this command to give the permissions.
sudo chown -R <jenkins user>:<jenkins group> /jenkins_root_path
here <jenkins user> and jenkins group is the user and group which you are running jenkins under.
If the jenkins user is a member in the sudoers list:
sudo rm -rf /Users/****/.jenkins/workflow-libs/testCollections
But this can be dangerous.
I would highly suggest you run the Jenkins process as the jenkins user/group and not muck around in there as your own user account.
This will ensure your file permissions are proper and that the jenkins process only has access to the areas it needs as well as letting you spin up new slaves without worrying about permissions and custom settings.
You can always use sudo to become the 'jenkins' user to work with the files.

Transfer to remote host using ssh (jenkins)

I have a compressed file in my jenkins workspace folder, I am trying to transfer that compressed file over ssh, but I got SSH: Transferred 0 file(s)
My Configurations are below-
Transfer set source file: my-files.zip
Remove Prefix:
Remote directory: /home/my-files
My Console Output:
Started by user Mizanur Rahman
SSH: Transferred 0 file(s)
Build step 'Send files or execute commands over SSH' changed build result to SUCCESS
Finished: SUCCESS
The first test would be to try and replicate that tranfer manually, from the server executing the job, with the user running the job.
On that server, try at least a:
ssh -Tv xxx#remote.com
That will confirm if you (as the user running the Jenkins job) actually establish an secure shell session. Replace xxx and remote.com by the remote user and remote server target for that session.

Resources