Proxmox GUI Session Timeout

[tomx1]

Hey,

could please someone let me know whats the default session timeout for the Proxmox GUI and where i can change this? The question has been asked several times now - so please Proxmox guys, just answer WHERE we can change this.

https://forum.proxmox.com/threads/default-gui-session-timeout.41786/
https://forum.proxmox.com/threads/proxmox-ve-session-timeout.3262/
https://forum.proxmox.com/threads/session-time-in-proxmox-ve-manager.1329/

Thanks!

 

[Mineralwasser]

well... I'm also looking for a solution to this.
Seems like this question was asked 2000 times but answeared never?

Shouldn't that be an easy thing to change the session timeout?

It is literally 5 minutes here on a fresh installation...

 

[Neox]

Here is the same, Proxmox 6.1.8
I start uploading an big ISO (6.8Go), it takes time, then my session timeout, even if I click or move the upload window around

If I reload, the upload keep going on but if i'm too long, ticket expires, upload fails

Is there any place to change session timeout ?

 

[hyperqube]

I also would love to know the answer to this. Its is insanely annoying to have it timeout after 5 mins of inactivity

 

[fabian]

there is no 5 minutes of inactivity on the PVE side. the tickets used for authentication are valid for 2 hours, and the web GUI refreshes it automatically in the background so you don't get logged out as long as you leave the tab open. some other special purpose tickets are valid for a very short period of time because they only authenticate the next request (e.g. for the VNC/SPICE connections).

 

[Jadan1213]

I'm going to have to call BS on that. It may not *Intentionally* be 5 minutes, but for some of us, myself included, it definitely is 5 minutes.

I can leave the PVE tab open, and stare at it, and about 5 minutes later, i get a login dialogue.
Or, I could be in the middle of trying to do something, and get an invalid ticket error and have to refresh the tab and login again.

You can tell us until you're blue in the face that there is no 5 minute timeout. Doesn't change the fact we're experiencing exactly that.

This is also a brand new install.

 

[BobhWasatch]

I think he's just pointing out that it isn't supposed to do that. So something is broken or misconfigured. Mine doesn't do that, for example.

Do you have a proxy or firewall in between you and the PVE server? Is the time on the server consistent with your client time? Does it still time out if you disable your extensions or browse in incognito mode? These are the kinds of things to look for.

ETA Also check cookie settings and flush the browser cache. Maybe you made some privacy settings that cause this timeout as a side effect.

 

[Jadan1213]

okay i misunderstood the message then. It could be the time thing. I get a lot of log errors about the time in the syslog. maybe it will correct itself?

 

[fabian]

okay i misunderstood the message then. It could be the time thing. I get a lot of log errors about the time in the syslog. maybe it will correct itself?

possibly. but you could also force it by setting the correct time / forcing an NTP sync / ...

we do apply a 5 minute fuzz to the ticket timestamp to reduce issues stemming from inconsistent time sync within a cluster. the ticket encodes the time of creation inside, and the client presents it to the server which then checks that that timestamp is
- at most 5 minutes in the future
- at most 2 hours + 5 minutes in the past (or shorter, if the key signing the ticket is less than 2 hours old)

there's some special magic for should-have-been-rotated keys, and we also check with both new and old key after it has been rotated to allow a seamless transition (keys get rotated once every 24 hours).

is this a cluster or a single node where you see the issue? looking at the mtime of /etc/pve/authkey.pub and /etc/pve/authkey.pubold compared to the current system time might shed some light. also, checking the log for key rotations ("auth key pair too old, rotating..") might be helpful.

 

[Jadan1213]

It is a single node. with having just set up the install, i left it running overnight. These were the errors i was getting.

Jun 07 15:13:24 krishna-pve1 systemd-timesyncd[668]: Synchronized to time server for the first time 216.126.233.109:123 (2.debian.pool.ntp.org).
Jun 07 15:13:32 krishna-pve1 pmxcfs[1020]: [status] notice: RRDC update error /var/lib/rrdcached/db/pve2-node/krishna-pve1: -1
Jun 07 15:13:32 krishna-pve1 pmxcfs[1020]: [status] notice: RRD update error /var/lib/rrdcached/db/pve2-node/krishna-pve1: /var/lib/rrdcached/db/pve2-node/krishna-pve1: illegal attempt to update using time 1591557212 when last update time is 1591572090 (minimum one second step)
Jun 07 15:13:32 krishna-pve1 pmxcfs[1020]: [status] notice: RRDC update error /var/lib/rrdcached/db/pve2-storage/krishna-pve1/local-lvm: -1
Jun 07 15:13:32 krishna-pve1 pmxcfs[1020]: [status] notice: RRD update error /var/lib/rrdcached/db/pve2-storage/krishna-pve1/local-lvm: /var/lib/rrdcached/db/pve2-storage/krishna-pve1/local-lvm: illegal attempt to update using time 1591557212 when last update time is 1591572090 (minimum one second step)
Jun 07 15:13:32 krishna-pve1 pmxcfs[1020]: [status] notice: RRDC update error /var/lib/rrdcached/db/pve2-storage/krishna-pve1/local: -1
Jun 07 15:13:32 krishna-pve1 pmxcfs[1020]: [status] notice: RRD update error /var/lib/rrdcached/db/pve2-storage/krishna-pve1/local: /var/lib/rrdcached/db/pve2-storage/krishna-pve1/local: illegal attempt to update using time 1591557212 when last update time is 1591572090 (minimum one second step)
Jun 07 15:13:42 krishna-pve1 pmxcfs[1020]: [status] notice: RRDC update error /var/lib/rrdcached/db/pve2-node/krishna-pve1: -1
Jun 07 15:13:42 krishna-pve1 pmxcfs[1020]: [status] notice: RRD update error /var/lib/rrdcached/db/pve2-node/krishna-pve1: /var/lib/rrdcached/db/pve2-node/krishna-pve1: illegal attempt to update using time 1591557222 when last update time is 1591572090 (minimum one second step)
Jun 07 15:13:43 krishna-pve1 pmxcfs[1020]: [status] notice: RRDC update error /var/lib/rrdcached/db/pve2-storage/krishna-pve1/local-lvm: -1

I don't appear to be getting those errors now, so maybe the time caught up. I'm going to leave the window open and see if it kicks me off after a few minutes.

 

[Jadan1213]

Okay, just wanted to post here, that since the time caught up properly, i haven't had the log out every few minutes issue. Looks like that was the issue in my case.

 

[System Error Message]

Hi i've been getting an even worse issue. During different times of the day the timeout is different, for instance during the day when i'm working, even when using the GUI it timesout in 2 minutes giving me ticket errors and having to refresh. Its annoying and frustrating.

Any way to change the timeout or remove it? this is a development cluster.

On a totally different cluster this issue doesnt happen. Odd that the more powerful cluster with older CPUs is having more issues than my embedded board cluster of ATOMs and ryzen SoCs. Even with SSDs and gigabit NICs, VM transfers across the cluster take overnight just for one with a 16GB drive using the default LVM thin. Currently the development cluster has 6 of the same nodes, going to add some more to it later

 

[fabian]

if you are having issues with tickets/sessions timing out, please check your hardware clock and time synchronization settings. this is basically only possible if the time of your cluster nodes is out of sync or doing wild jumps.

 

[System Error Message]

if you are having issues with tickets/sessions timing out, please check your hardware clock and time synchronization settings. this is basically only possible if the time of your cluster nodes is out of sync or doing wild jumps.

however is there a way to remove the timeout? this isnt something for production or something exposed, just experimental.

 

[fabian]

the timeout is not configurable, you need to fix your setup. jumps in system time or difference within a cluster will lead to other problems as well.

 

[ElDark258]

Hi dears, sorry for reviving this, but I'm facing the same issue as OP, however I did check that my server's time has been properly set, the BIOS clock's also correctly adjusted, and yet regardless of the user that logs in, sessions won't last more than 5 minutes, sometimes even less than 2 minutes... Am I doing something wrong?

EDIT: It's worth to mention that this started happening after I removed this server from a cluster, I wanted to try that feature with another proxmox server that we have at the office, but the only difference is that in the other server this is not a thing

 

[fabian]

check log messages of pvestatd and pvedaemon (journalctl -b -u pvestatd -u pvedaemon) for references to "authkey", and check the timstamps of the authkey files (ls -lha /etc/pve/authkey*). also, pveversion -v output wouldn't hurt

 

[ElDark258]

check log messages of pvestatd and pvedaemon (journalctl -b -u pvestatd -u pvedaemon) for references to "authkey", and check the timstamps of the authkey files (ls -lha /etc/pve/authkey*). also, pveversion -v output wouldn't hurt

Hi Fabian, thanks for your response, actually... I found the fix about 5 or 10 minutes ago lol, it was in another thread, but since I already closed the page, I'll repost here in case somebody else needs it.

Long story short, Proxmox has a very smart way of handling the sessions, in that as long as the system has the right date/time it all should be good. Now for this to be accomplished in my particular case, since my network managers don't allow use of NTP protocol (reasons unkown tbh..) I can't sync my clocks with the network, therefore you gotta make sure:

1. That the command hwclock will output the correct date/time (refer to man 5 hwclock for usage)
2. That the date/time returned by the date command is the right one and in sync with the previous command
3. Perform the commands:
# touch /etc/pve/authkey.pub # touch /etc/pve/authkey.pub.old

These 3 steps should help solve the web GUI session timeout.
HTH!