Can't login to webmin [7.305]

BarryG · #1 (**permalink**) 12-25-2008, 08:16 AM

Hi,
I was going to post that I can no longer log into the VPN using the Linux OpenVPN client, however, I now see that I can't login to webmin either.
"Invalid username or password."

1. Is there still a problem with db corruption or whatever which could cause this?

2. would VPN login failures lock my account from webmin?

3. I can login via SSH. What should I do now?

I first noticed the VPN login wasn't working yesterday.

I've been running 7.305 for 28 days. That is also the last time the firewall was rebooted, and it is on a large UPS.

dmesg shows no errors

kernel logs are empty all this month except for 2 occasions where I power cycled my internal ethernet switch, for which there are the expected link down/link up messages.

httpd.log has nothing unusual

Also, I'm not getting emails about the webmin login failures.

Thanks,
Barry

BarryG · #2 (**permalink**) 12-25-2008, 08:18 AM

confd.log during a login attempt:

Code:

2008:12:25-01:15:10 (none) confd[10320]: id="3106" severity="info" sys="System" sub="confd" name="authentication successful" client="dns-resolver.plx" facility="system" user="system" srcip="127.0.0.1"
2008:12:25-01:15:10 (none) confd[10320]: id="3100" severity="info" sys="System" sub="confd" name="closing session DtYgFaPkscQkMJhdptGB: logout" client="dns-resolver.plx" facility="system" user="system" srcip="127.0.0.1"
2008:12:25-01:15:16 (none) confd[10204]: id="3100" severity="info" sys="System" sub="confd" name="logout" client="index.plx" facility="" user="system" srcip="0.0.0.0"
2008:12:25-01:15:17 (none) confd[10325]: id="310o" severity="warn" sys="System" sub="confd" name="authentication failed" client="index.plx" facility="webadmin" user="barry" srcip="192.168.11.230"
2008:12:25-01:15:17 (none) confd[10325]: id="3100" severity="warn" sys="System" sub="confd" name="PERM_DENIED (permission denied)" client="index.plx" facility="webadmin" user="anonymous" srcip="192.168.11.230"
2008:12:25-01:15:17 (none) confd[10325]: id="3100" severity="info" sys="System" sub="confd" name="logout" client="index.plx" facility="webadmin" user="anonymous" srcip="192.168.11.230"

BarryG · #3 (**permalink**) 12-25-2008, 08:19 AM

Code:

 ll /tmp/
total 673960
-rw------- 1 root root     12288 Dec 23 12:43 aua_auth_cache.db
-rw-r--r-- 1 root root         0 Dec 25 01:15 aua_auth_cache.db.lock
-rw-r--r-- 1 root root         0 Dec 25 01:15 aua_confd_cache.db.lock
-rw------- 1 root root  32098548 Dec 25 01:18 confd-debug.log
-rw------- 1 root root     20480 Dec 25 01:17 dnsresolver.db
-rw-r--r-- 1 root root         0 Dec 25 01:17 dnsresolver.db.lock
-rw------- 1 root root     68285 Dec 24 03:03 mdwdebug.log
-rw------- 1 root root 657244160 Dec 25 01:18 netacc_sql.cache
drwxr-xr-x 2 root root      4096 Dec 25 00:00 pdk-root

BarryG · #4 (**permalink**) 12-25-2008, 08:23 AM

Not sure if I should delete any of those files... they all have a current timestamp.

deleted mdwdebug.log as it's older, but I still can't login.

going to try reboot...

Barry

BarryG · #5 (**permalink**) 12-25-2008, 08:35 AM

rebooted.
can login to webmin again.
will try vpn later

/tmp looks better for now

Code:

 ll /tmp
total 136
-rw------- 1 root     root     12288 Dec 25 01:27 aua_auth_cache.db
-rw-r--r-- 1 root     root         0 Dec 25 01:28 aua_auth_cache.db.lock
-rw------- 1 root     root     12288 Dec 25 01:28 aua_confd_cache.db
-rw-r--r-- 1 root     root         0 Dec 25 01:28 aua_confd_cache.db.lock
-rw-r--r-- 1 root     root       196 Dec 25 01:27 auadebug.log
-rw------- 1 root     root     43098 Dec 25 01:29 confd-debug.log
-rw-r--r-- 1 root     root         9 Dec 25 01:28 dhcpd-interfaces
-rw------- 1 root     root     12288 Dec 25 01:28 dnsresolver.db
-rw-r--r-- 1 root     root         0 Dec 25 01:28 dnsresolver.db.lock
-rw-r--r-- 1 root     root         0 Dec 25 01:27 dnsresolver.log
-rw------- 1 root     root     41324 Dec 25 01:28 mdwdebug.log
drwxr-xr-x 2 root     root      4096 Dec 25 01:27 pdk-root
-rw------- 1 postgres postgres    77 Dec 25 01:27 postgres.log

I'm lowering the IPS, PacketFilter, and Accounting settings to "2 weeks" for now; they were set to "1 month".

Drive is a 20GB, fwiw.

Barry

BarryG · #6 (**permalink**) 12-25-2008, 08:49 AM

FWIW, I'm currently setting up v7 at work; server has 73GB SCSI disks, and a lot more traffic than I have at home. v6 has been working great, but I need to be sure that v7 won't have problems with accounting, etc. I like how I can keep MANY months of accounting data in v6; I'm not sure what I'll be able to do in v7, but it'd be nice to know.

Thanks,
Barry

KSeemann · #7 (**permalink**) 12-26-2008, 02:21 PM

Hi BarryG,

looking at the Name of the biggest File in /tmp/ i am assuming, that something had gone wrong with the Network Accounting. Maybe it was not able to dump the detail Data in to the SQL Database so the temporary File never shrunk.

Quote:

Originally Posted by BarryG

Code:

-rw------- 1 root root 657244160 Dec 25 01:18 netacc_sql.cache

And on my 80GB Disk the /tmp/ is still only 1.8GB big, so a bigger Disk might have bought you only a few days (depending on when the Problem startet of course...). The /var/log/ is 36GB big, so it should be able to hold some Water. 1 Month of Logfiles consumes 1% here. But being a Home User with v7, i have no Idea how that scales...

With the v6 at Work i had to dial down the Log Archive to 90 Days, because 1 Year would not fit on the 32GB Log Partition (on a 73GB Disk).The 90 Days consume 25% of /var/log/. On a realy busy Day i get up to 1GB in Logs witch results in a 65MB tgz compressed File in the remote Log Archive.

BarryG · #8 (**permalink**) 12-27-2008, 12:47 AM

My /tmp is 688M, and after 1.7days uptime, the accounting file is at 43MB.
Note that I've already lowered my accounting settings to only keep 2 weeks.

Also, I am now able to login to the VPN again, at least internally

Thanks,
Barry

BarryG · #9 (**permalink**) 12-31-2008, 09:19 PM

I think there's still a problem...

Code:

loginuser@fw:/tmp > uptime
  2:17pm  up 6 days 12:51,  1 user,  load average: 0.67, 0.31, 0.31
loginuser@fw:/tmp > ll /tmp/
total 175916
-rw------- 1 root      root         12288 Dec 25 23:04 aua_auth_cache.db
-rw-r--r-- 1 root      root             0 Dec 25 23:04 aua_auth_cache.db.lock
-rw------- 1 root      root         12288 Dec 25 23:04 aua_confd_cache.db
-rw-r--r-- 1 root      root             0 Dec 25 23:04 aua_confd_cache.db.lock
-rw-r--r-- 1 root      root           196 Dec 25 01:27 auadebug.log
-rw------- 1 root      root       7840415 Dec 31 14:17 confd-debug.log
-rw-r--r-- 1 root      root             9 Dec 25 01:28 dhcpd-interfaces
-rw------- 1 root      root         20480 Dec 31 14:16 dnsresolver.db
-rw-r--r-- 1 root      root             0 Dec 31 14:16 dnsresolver.db.lock
-rw-r--r-- 1 root      root             0 Dec 25 01:27 dnsresolver.log
-rw-r--r-- 1 root      root             0 Dec 25 22:59 ipsec_status.debug
-rw------- 1 root      root         49359 Dec 31 02:40 mdwdebug.log
-rw------- 1 root      root     170545152 Dec 31 14:05 netacc_sql.cache
-rw-r--r-- 1 root      root             0 Dec 31 14:17 netacc_sql.cache.lock
drwxr-xr-x 2 root      root          4096 Dec 27 01:15 pdk-root
-rw------- 1 postgres  postgres        77 Dec 25 01:27 postgres.log
-rw-r--r-- 1 root      root             0 Dec 25 01:31 reversednsresolver.log
-rw------- 1 root      root       1445888 Dec 31 14:17 sql.cache
-rw-r--r-- 1 root      root             0 Dec 31 14:17 sql.cache.lock
drwx------ 2 loginuser users         4096 Dec 31 14:17 ssh-mNvGH27401
loginuser@fw:/tmp > df -h
Filesystem            Size  Used Avail Use% Mounted on
rootfs                5.3G  1.1G  4.0G  22% /
udev                  253M   60K  252M   1% /dev
/dev/disk/by-label/root
                      5.3G  1.1G  4.0G  22% /
/dev/disk/by-label/boot
                      342M   14M  311M   5% /boot
/dev/disk/by-label/storage
                      4.3G  754M  3.3G  19% /var/storage
/dev/disk/by-label/log
                      5.6G  2.1G  3.3G  40% /var/log

Still running 7.305, btw.

BrucekConvergent · #10 (**permalink**) 01-01-2009, 12:47 AM

I haven't really seen any problems like this at any sites... is this a new config, or one you converted from V6?