[SOLVED] WebUI denies login

[Sam O'Riil]

Hello! I have weird problem: after fresh install of Proxmox using Hetzner install script on Debian Buster (10.3 minimal) authentication via WebUI always fails wrong password. For any user and any realm. I've tried creating new users in system or PVE and add via SSH (auth using SSH key) using pveum but no luck.

BTW, in Chromium I get blank screen. In Firefox and Google Chrome it's all OK, so it's not a problem for me, just saying.

Any suggestion about cause of this? What can I do? I don't mind to reinstall the whole thing right way but using ISO is not an option here.

P.S. I've similar problem on older instance (5.4-13), but not 100% attempts fail, just few first.

proxmox-ve: 6.1-2 (running kernel: 5.3.18-3-pve)
pve-manager: 6.1-8 (running version: 6.1-8/806edfe1)
pve-kernel-helper: 6.1-8
pve-kernel-5.3: 6.1-6
pve-kernel-5.3.18-3-pve: 5.3.18-3
ceph-fuse: 12.2.11+dfsg1-2.1+b1
corosync: 3.0.3-pve1
criu: 3.11-3
glusterfs-client: 5.5-3
ifupdown: residual config
ifupdown2: 2.0.1-1+pve8
libjs-extjs: 6.0.1-10
libknet1: 1.15-pve1
libpve-access-control: 6.0-6
libpve-apiclient-perl: 3.0-3
libpve-common-perl: 6.0-17
libpve-guest-common-perl: 3.0-5
libpve-http-server-perl: 3.0-5
libpve-storage-perl: 6.1-5
libqb0: 1.0.5-1
libspice-server1: 0.14.2-4~pve6+1
lvm2: 2.03.02-pve4
lxc-pve: 3.2.1-1
lxcfs: 4.0.1-pve1
novnc-pve: 1.1.0-1
proxmox-mini-journalreader: 1.1-1
proxmox-widget-toolkit: 2.1-3
pve-cluster: 6.1-4
pve-container: 3.0-23
pve-docs: 6.1-6
pve-edk2-firmware: 2.20200229-1
pve-firewall: 4.0-10
pve-firmware: 3.0-7
pve-ha-manager: 3.0-9
pve-i18n: 2.0-4
pve-qemu-kvm: 4.1.1-4
pve-xtermjs: 4.3.0-1
qemu-server: 6.1-7
smartmontools: 7.1-pve2
spiceterm: 3.1-1
vncterm: 1.6-1

 

[Moayad]

Hi,


Make sure when you login to set Realm as "Linux PAM standard authentication", the default user for PVE is root




I hope this helps!

 

[Sam O'Riil]

Make sure when you login to set Realm as "Linux PAM standard authentication", the default user for PVE is root

Yes, sure I've checked that.


What kind of debugging I should do to find where failure happens? I'm ready to reinstall, but I first want to confirm I won't get there again.

 

[Moayad]

Hi,

What kind of debugging I should do to find where failure happens?

journalctl -u pvedaemon

Do you have a special character in your password?

And please post output of command: cat /etc/pve/user.cfg

 

[Sam O'Riil]

journalctl -u pvedaemon

Nothing helpful... Btw, PAM realm failed attempts don't get there.

Do you have a special character in your password?

No. Length below 64 chars.

And please post output of command: cat /etc/pve/user.cfg

user:nokim@pam:1:0:::some@mail1:::
user:root@pam:1:0::::::
user:semoriil@pve:1:0:::some@mail2:::

group:admin:semoriil@pve:System Administrators:



acl:1:/:@admin:Administrator:

 

[Moayad]

Huh!

Could you try to change your password and see if make effects? passwd root

 

[Sam O'Riil]

Could you try to change your password and see if make effects? passwd root

Sure. No change.
UPD. From auth.log

IPCC.xs[1431]: pam_unix(common-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=root

 

[Sam O'Riil]

I suspect password gets corrupted somewhere on the way...

pamtester -v unix root authenticate
pamtester: invoking pam_start(unix, root, ...)
pamtester: performing operation - authenticate
Password:
pamtester: successfully authenticated

 

[Moayad]

Thank you

Is the time on the Host and client is correct?

Please tried a different browser and try to restart pvedaemon as well

systemctl start pveproxy pvedaemon

 

[Sam O'Riil]

Is the time on the Host and client is correct?

Please tried a different browser and try to restart pvedaemon as well

systemctl start pveproxy pvedaemon

Yes, time is correct. It's still the same with Firefox and Google Chrome.

 

[Moayad]

have you tried with curl to see if you can get CSRF token? [0]

curl -k -d "username=root@pam&password=yourpassword" https://10.0.0.1:8006/api2/json/access/ticket
if you get token, your creds are ok should login into GUI.

[0] https://pve.proxmox.com/wiki/Proxmox_VE_API#Authentication

 

[Sam O'Riil]

have you tried with curl to see if you can get CSRF token?

No. Just tried, it returns {"data":null} and HTTP code 401. For my @pve user as well.

 

[Sam O'Riil]

OK, solved it. Thank you for the help! I was right about password was corrupt somewhere, but it was all my mistake. I didn't type passwords myself and some weird stuff happened with this text on copy-paste. When I copy it from text file and paste it in terminal and browser I get different results. If I copy from terminal - results are same. Really old mistake, but still happens with me.

This might be worth mention somewhere in troubleshooting section...

 

[fyrmangeoff]

Thank you for asking the question. This also helped me...