Xen provision/script. not enough permissions

RouterOS Scripting
1

Hello!

I’m trying to automate provisioning of CHR running on VDS (host based on xcp-ng XEN).
From the documentation https://wiki.mikrotik.com/wiki/Manual:CHR#XenI realized that I can use xenstore to pass some script to the virtual machine via path (‘vm-data/provision/script’).
I tried to pass this simple script to change the default admin password

user/set admin password=SuperDuperPass

and got the error “not enough permissions (9)”.

I can’t find any information on how to overcome this error or get permissions for this “provisioning” scenario.

Any ideas?

2

Hi,

From mikrotik RoutrerOS documentation (https://help.mikrotik.com/docs/display/ROS/User):

Config Policies:

reboot - policy that allows rebooting the router
read - policy that grants read access to the router’s configuration. All console commands that do not alter router’s configuration are allowed. Doesn’t affect FTP
write - policy that grants write access to the router’s configuration, except for user management. This policy does not allow to read the configuration, so make sure to enable read policy as well
policy - policy that grants user management rights. Should be used together with the write policy. Allows also to see global variables created by other users (requires also ‘test’ policy).
test - policy that grants rights to run ping, traceroute, bandwidth-test, wireless scan, snooper, fetch, email and other test commands
sensitive - grants rights to change “hide sensitive” option, if this policy is disabled sensitive information is not displayed.
sniff - policy that grants rights to use packet sniffer tool.

So, you should set: write, policy for your script

3

@miku, thank you.
I know that for “stored” scripts I can put some privileges, but! as you can see from my post I do not store this script, I’m passing it via xenstore.
So virtual machine get and run it on fly without storing on hdd.
That is the problem.
I do not know from which user it starts and how to change privileges for it.

4

@splastunov,
Unfortunately I don’t know xenstore. Maybe you’ll find something in the logs after all. Failed script execution should be in the log.

5

Nothing in logs, no information in documentation how does “start up” script working.

Because of that I’m asking here…

6

Any ideas from @mikrotik team?

7

up up

8

This forum is a user-to-user channel. If you want a direct-to-MikroTik support channel, it’s here.

9

Did you open a ticket and get or otherwise figure out a workaround for this?

I’m trying this on Proxmox, but it’s the same problem - I can’t replace the blank admin user password via the guest agent socket at the moment.