Hi, Just wondering if anyone has any ideas regarding why my admin user cannot login from time to time? The scenario is as follows: [code]/usr/local/openvpn_as/bin/ovpn-init[/code] Was run and a new user 'vpnadmin' created. A password was set with [code]passwd vpnadmin[/code] This admin account was working fine via the gui and was used to edit the server config. Nothing was changed password wise in either the admin panel or on the server itself but from time to time I cannot login with the same details that were working previously. I've got the other sysadmin to check from his machine with the same details. He has the same issue, sometimes he can log in, sometimes not. But he can never log in when I am also unable to login. So that's one commonality. I've restarted the OpenVPN server [code]service openvpnas restart[/code] I've rebooted the server. So far I've ruled out: Browser storing wrong password. Copy paste issues with password. Typing issues with password. User vpnadmin having it's local system account locked out. User vpnadmin account being expired If I wait a while I can login, but it's never the 15 minutes that are specified in the documentation as being the default lock out period (if I was using the wrong credentials). It's usually longer, up to an hour before I am allowed in. Checking the openvpnas.log on a failed login gives: [code] WEB OUT: "2015-04-01 16:16:56+0100 [UDSProxyQueryProtocol,client] Web login authentication failed: {'status': 1, 'reason': 'PAM auth failed: Authentication failure', 'user': 'vpnadmin'}"[/code] OpenVPN AS version 2.0.12 Platform: RHEL 6.6 License: Two user trial Hope someone can help. Regards, R.

Cannot login to admin UI with bootstrap user

rokeeffe

Hi,

Just wondering if anyone has any ideas regarding why my admin user cannot login from time to time?

The scenario is as follows:

/usr/local/openvpn_as/bin/ovpn-init

Was run and a new user 'vpnadmin' created. A password was set with

passwd vpnadmin

This admin account was working fine via the gui and was used to edit the server config.

Nothing was changed password wise in either the admin panel or on the server itself but from time to time I cannot login with the same details that were working previously. I've got the other sysadmin to check from his machine with the same details. He has the same issue, sometimes he can log in, sometimes not. But he can never log in when I am also unable to login. So that's one commonality.

I've restarted the OpenVPN server

service openvpnas restart

I've rebooted the server.

So far I've ruled out:
Browser storing wrong password.
Copy paste issues with password.
Typing issues with password.
User vpnadmin having it's local system account locked out.
User vpnadmin account being expired

If I wait a while I can login, but it's never the 15 minutes that are specified in the documentation as being the default lock out period (if I was using the wrong credentials). It's usually longer, up to an hour before I am allowed in.

Checking the openvpnas.log on a failed login gives:

WEB OUT: "2015-04-01 16:16:56+0100 [UDSProxyQueryProtocol,client] Web login authentication failed: {'status': 1, 'reason': 'PAM auth failed: Authentication failure', 'user': 'vpnadmin'}"

OpenVPN AS version 2.0.12
Platform: RHEL 6.6
License: Two user trial

Hope someone can help.
Regards,
R.

maikcat

since PAM is denying access ,do you see anything interesting inside /var/log/secure or /var/log/messages?

Michael.

rokeeffe

Hi Michael/maikcat,

Cheers for the reply.
IP's and domains removed.

tail -200f /var/log/secure
Apr  2 10:11:17 vpn python: pam_tally2(openvpnas:auth): user vpnadmin (508) tally 34, deny 5
Apr  2 10:11:52 vpn python: pam_tally2(openvpnas:auth): user vpnadmin (508) tally 35, deny 5
Apr  2 10:12:10 vpn python: pam_tally2(openvpnas:auth): user vpnadmin (508) tally 36, deny 5

tail -300f /var/log/messages
Apr  2 10:11:17 vpn audispd: node=vpn.domain.tld type=USER_AUTH msg=audit(1427965877.347:10262): user pid=25923 uid=0 auid=500 ses=885 msg='op=PAM:authentication acct="vpnadmin" exe="/usr/local/openvpn_as/bin/python" hostname=***** addr=***** terminal=? res=failed'
Apr  2 10:11:35 vpn snmpd[1781]: Connection from UDP: [172.26.132.50]:1507->[172.29.132.100]
Apr  2 10:11:52 vpn audispd: node=vpn.domain.tld type=USER_AUTH msg=audit(1427965912.780:10263): user pid=25923 uid=0 auid=500 ses=885 msg='op=PAM:authentication acct="vpnadmin" exe="/usr/local/openvpn_as/bin/python" hostname=***** addr=***** terminal=? res=failed'
Apr  2 10:11:58 vpn snmpd[1781]: Connection from UDP: [172.26.132.50]:1602->[172.29.132.100]
Apr  2 10:12:10 vpn audispd: node=vpn.domain.tld type=USER_AUTH msg=audit(1427965930.066:10264): user pid=25923 uid=0 auid=500 ses=885 msg='op=PAM:authentication acct="vpnadmin" exe="/usr/local/openvpn_as/bin/python" hostname=127.0.0.1 addr=127.0.0.1 terminal=? res=failed'

The first two fails are from me in the office, the second I imagine is from the other admin that is connected to the VPN.
By the way I timed the latest lockout and I could log in after 15 mins were up. I thought according to the documentation that only non bootstrap users were affected by the lockout?

Regards,
Ronan.

maikcat

since i am not an AS expert i will kindly ask you to post your PAM settings...

Michael.

rokeeffe

Here you go.

cat /etc/pam.d/openvpnas
#auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth       include      system-auth
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
session    optional     pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      system-auth
-session   optional     pam_ck_connector.so

Cheers

maikcat

/etc/pam.d/system-auth also please...

Michael.

rokeeffe

Thanks for the reply,

cat /etc/pam.d/system-auth

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        required      pam_tally2.so onerr=fail audit silent deny=5 unlock_time=900
auth        sufficient    pam_fprintd.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_unix.so remember=5
password    required      pam_deny.so
password    required      pam_cracklib.so try_first_pass retry=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

The line that stands out to me is

auth        required      pam_tally2.so onerr=fail audit silent deny=5 unlock_time=900

maikcat

from pam_tally2 man page

unlock_time=n
Allow access after n seconds after failed attempt. If this option is used the user will be locked out for the
specified amount of time after he exceeded his maximum allowed attempts. Otherwise the account is locked until the
lock is removed by a manual intervention of the system administrator.

I cannot login with the same details that were working previously. I've got the other sysadmin to check from his machine with the same details. He has the same issue, sometimes he can log in, sometimes not

By the way I timed the latest lockout and I could log in after 15 mins were up

the unlock_time specified as 900 (secs) is 15 mins,
so yes pam_tally is ALLOWING you to login , but with 5 failed attempts it will lock you again for 15 mins.

you can reset pam_tally2 by issueing

pam_tally2 -u vpnadmin -r

also you can check the failures by using pam_tally2 command...

if you grep audisp to your log what is the complete output?is there any possibility that someone
is hammering your server...?

Michael.

rokeeffe

Hi Michael,

Many thanks for that and apologies on the delay in updating.
I went through the logs and did not see any failures from IP's other than our own office. So the server was definitely not getting hammered.

At this stage I'll have to put it down to a user error that I believed that I had previously ruled out.
What that is I cannot tell though.

I'll monitor the situation and hopefully get to the bottom of it.

Many thanks.
R.

rokeeffe

Just to provide more info.

I now believe this issue is caused by changing changing vpn settings via the web admin gui.

The scenario I have set up is that the admin gui on 943 is only available on a sub interface address once you actually vpn in.

1. So I vpn in.
2. Change some setting, save it, click 'update running server'.
3. I get kicked from the vpn obviously so I cannot access the admin gui.
4. I reconnect to the vpn and cannot login to the admin gui.

In the meantime the pam_tally2 count shoots up on my server. From 0 to anywhere from 7 to 14 so far.

So something is happening with the browser in the background is my guess.