(v6) Unable to login (WebGui: root)

[TomasSystems]

Hello there,

Today, out of the blue I am suddenly unable to log in to my Proxmox Web GUI.
Additional users work (e.g sub-users who can access some machines). Using 'root' will not work whatsoever, it just errors with 'Login failed. Please try again'. There are two machines in the cluster, both report the same error.

proxmox-ve: 6.4-1 (running kernel: 5.4.128-1-pve)
pve-manager: 6.4-13 (running version: 6.4-13/9f411e79)
pve-kernel-5.4: 6.4-5
pve-kernel-helper: 6.4-5
pve-kernel-5.4.128-1-pve: 5.4.128-2
ceph-fuse: 12.2.11+dfsg1-2.1+b1
corosync: 3.1.2-pve1
criu: 3.11-3
glusterfs-client: 5.5-3
ifupdown: residual config
ifupdown2: 3.0.0-1+pve4~bpo10
libjs-extjs: 6.0.1-10
libknet1: 1.20-pve1
libproxmox-acme-perl: 1.1.0
libproxmox-backup-qemu0: 1.1.0-1
libpve-access-control: 6.4-3
libpve-apiclient-perl: 3.1-3
libpve-common-perl: 6.4-3
libpve-guest-common-perl: 3.1-5
libpve-http-server-perl: 3.2-3
libpve-storage-perl: 6.4-1
libqb0: 1.0.5-1
libspice-server1: 0.14.2-4~pve6+1
lvm2: 2.03.02-pve4
lxc-pve: 4.0.6-2
lxcfs: 4.0.6-pve1
novnc-pve: 1.1.0-1
proxmox-backup-client: 1.1.13-2
proxmox-mini-journalreader: 1.1-1
proxmox-widget-toolkit: 2.6-1
pve-cluster: 6.4-1
pve-container: 3.3-6
pve-docs: 6.4-2
pve-edk2-firmware: 2.20200531-1
pve-firewall: 4.1-4
pve-firmware: 3.2-4
pve-ha-manager: 3.1-1
pve-i18n: 2.3-1
pve-qemu-kvm: 5.2.0-6
pve-xtermjs: 4.7.0-3
pve-zsync: 2.2
qemu-server: 6.4-2
smartmontools: 7.2-pve2
spiceterm: 3.1-1
vncterm: 1.6-2
zfsutils-linux: 2.0.5-pve1~bpo10+1

Thank you.

 

[Pifouney]

Hello there,

Today, out of the blue I am suddenly unable to log in to my Proxmox Web GUI.
Additional users work (e.g sub-users who can access some machines). Using 'root' will not work whatsoever, it just errors with 'Login failed. Please try again'. There are two machines in the cluster, both report the same error.

proxmox-ve: 6.4-1 (running kernel: 5.4.128-1-pve)
pve-manager: 6.4-13 (running version: 6.4-13/9f411e79)
pve-kernel-5.4: 6.4-5
pve-kernel-helper: 6.4-5
pve-kernel-5.4.128-1-pve: 5.4.128-2
ceph-fuse: 12.2.11+dfsg1-2.1+b1
corosync: 3.1.2-pve1
criu: 3.11-3
glusterfs-client: 5.5-3
ifupdown: residual config
ifupdown2: 3.0.0-1+pve4~bpo10
libjs-extjs: 6.0.1-10
libknet1: 1.20-pve1
libproxmox-acme-perl: 1.1.0
libproxmox-backup-qemu0: 1.1.0-1
libpve-access-control: 6.4-3
libpve-apiclient-perl: 3.1-3
libpve-common-perl: 6.4-3
libpve-guest-common-perl: 3.1-5
libpve-http-server-perl: 3.2-3
libpve-storage-perl: 6.4-1
libqb0: 1.0.5-1
libspice-server1: 0.14.2-4~pve6+1
lvm2: 2.03.02-pve4
lxc-pve: 4.0.6-2
lxcfs: 4.0.6-pve1
novnc-pve: 1.1.0-1
proxmox-backup-client: 1.1.13-2
proxmox-mini-journalreader: 1.1-1
proxmox-widget-toolkit: 2.6-1
pve-cluster: 6.4-1
pve-container: 3.3-6
pve-docs: 6.4-2
pve-edk2-firmware: 2.20200531-1
pve-firewall: 4.1-4
pve-firmware: 3.2-4
pve-ha-manager: 3.1-1
pve-i18n: 2.3-1
pve-qemu-kvm: 5.2.0-6
pve-xtermjs: 4.7.0-3
pve-zsync: 2.2
qemu-server: 6.4-2
smartmontools: 7.2-pve2
spiceterm: 3.1-1
vncterm: 1.6-2
zfsutils-linux: 2.0.5-pve1~bpo10+1

Thank you.

Hey,

Try to ssh connect.
If you can, please share yours logs, and describes after what this is happened.

Best regards,

 

[ViennaTux]

Hi, something similar is happening to the 2-node cluster at a customer's site.
We did a gradual install in parallel to vmware, where we first removed 1 esx and installed pve and after successful migration of all xervers and desktops moved the other esx to pve.
It worked for now nearly half a year but out of the blue since a few days I can not longer login via webgui on one of the px servers.
Login via SSH with password and publickey works both, also the webgui login on the other node. I can manage both servers from one node, but not the other.
I can find nothing in /var/auth.log et.al.
Any ideas?

 

[BobhWasatch]

Maybe too obvious, but did you make sure to select the Linux PAM realm when logging in as root?

 

[ViennaTux]

It was too obvious, and I did.
The solution was to remove and re-add the hostname of the unresponsive node in the DNS.
Unfortunately there is a M$ based DNS as primary DNS server, while the secondary is a Linux server.
The WinDNS Server expired the IP address for the node and sent the changes to the linux server. So the entry was still there but got not delivered in answer to the dns query...

thx to microschrott