使用NamedPipe访问Windows服务之间的安全性

Question

I have a C/C++ windows service implementation that is deployed on two different servers, using a NamedPipe so that they can communicate with each other.

I followed the least privilege principle, assigning the service account to "NT AUTHORITY/NetworkService", creating the NamedPipe with a Security Descriptor that has 'Read permissions' (A;OICI;GR;;;NS), blocked anonymous access, blocked all built-in guests, Grant all rights to logged users and Administrators group.

The services are giving me an "Access Denied (0x5)" error.

Here are the things I tried:

1. I tried to give all permissions for the "NetworkService" account. I know it is bad :( but just to see whether it works or not! Access Denied

2. Allowed read permission to Anonymous users (I read that the "NetworkService" account presents anonymous credentials to other computers on the network). Access Denied

The service is working with my console test application :( but not with another services. The security is critical and I just want both servers to be able to communicate with each other.

Can anyone tell me, whether I should create a specific account for each service in both servers?

The servers are not in a Domain, so I am not sure how to create a network wide account, or even if it is possible. I am not so good with Windows administration stuff!

Is this the correct direction to take to get the services to communicate with each other?

Answer 1

Sounds like you have a design issue.

When you wrote "creating the NamedPipe with a Security Descriptor that has 'Read permissions'", the question should be "read permissions for whom ?". Permissions are always tied to trustees.

In Windows, trustees don't exist in vacuum. They're always defined in some scope. Without a central user database (Active Directory), that would be the local scope of each computer. And two computers have distinct, non-overlapping sets of trustees. Administrator on one machine is unrelated to Administrator on another.

So when you give NetworkService all access to a NamedPipe on one computer, that probably meant you gave the NetworkService trustee from that sam computer access. Not NetworkService from other computers!

Fundamentally, without a Primary Domain Controller to function as a shared authority, two Windows PC's just won't trust each other . Each is its own security authority.