[BlueOnyx:27210] Re: 5211R error GUI login after 2fa

JW Ronken jwronken at gmail.com
Thu Aug 22 13:17:02 -05 2024


Hi Michael
Thanks for the quick response!

Using the debugmode:
Class "Sonata\GoogleAuthenticator\GoogleAuthenticator" not found


When I check the SERVER tab;
REQUEST_TIME_FLOAT

1724349813.4888																	

REQUEST_TIME

1724349813																	

argv

Array
(
    [0] => auth_check=2FACHECK
)

$_SESSION
KeyValue
__ci_last_regenerate

1724349604																	

expired_url /expired/true/target/login?auth_check=2FACHECK
actual_url login?auth_check=2FACHECK


Which made me check the time but it's 100% correct on using NTP pool.ntp.org
in GMT +2:00

*/usr/sausalito/ui/chorizo/ci4/Modules/Base/User/Controllers/Login.php* at
line *76*

69                 }70             }71             return
$backupCodes;72         }73     }74 75     public function
verifyCode($username, $code) {76         $g = new
GoogleAuthenticator();77         $secretKey =
Login::getSecretKey($username);78 79         // First, check if the
input code is a valid TOTP code:80         if
($g->checkCode($secretKey, $code)) {81             return true; // The
TOTP code is correct82         }83         else {



/usr/sausalito/ui/chorizo/ci4/Modules/Base/User/Controllers/Login.php : 454
  —  User\Controllers\Login->verifyCode

447
$CI->cceClient->authkey($form_data['username_field'], $sessionId);448
449                 bx_error_log("Login.php: Updating Session saved
'System' Object with the full data. auth_stage: $auth_stage");450
           $CI->setSystem($CI->cceClient->get($system['OID'], ''));451
452                 if (($auth_stage === '2FACHECK') &&
(isset($form_data['actual_token_field']))) {453                     //
2FA via Google-Authenticator:454                     if
(!Login::verifyCode($form_data['username_field'],
$form_data['actual_token_field'])) {455
bx_error_log("Login.php: Invalid login attempt due to 2FA failure. I
will remember this!");456
$CI->add_invalid_login();457 458
setcookie("sessionId", 'expired', "0", "/");459
 setcookie("logout", '2fafail', time()+60, "/");460
     @session()->destroy();461
$CI->setUserLogged();



   1.

   SYSTEMPATH/CodeIgniter.php : 927   —  User\Controllers\Login->login ()

   920             $output = $class->_remap($this->method,
$params);921         } else {922             // This is a Web request
or PHP CLI request923             $params =
$this->router->params();924 925             $output =
method_exists($class, '_remap')926                 ?
$class->_remap($this->method, ...$params)927                 :
$class->{$this->method}(...$params);928         }929 930
$this->benchmark->stop('controller');931 932         return
$output;933     }934

   2.

   SYSTEMPATH/CodeIgniter.php : 482   —  CodeIgniter\CodeIgniter->runController
   ( arguments <https://ds50.dyanix.it:81/login?auth_check=2FACHECK#> )

   475             if (! method_exists($controller, '_remap') && !
is_callable([$controller, $this->method], false)) {476
throw PageNotFoundException::forMethodNotFound($this->method);477
       }478 479             // Is there a
"post_controller_constructor" event?480
Events::trigger('post_controller_constructor');481 482
$returned = $this->runController($controller);483         } else {484
           $this->benchmark->stop('controller_constructor');485
     $this->benchmark->stop('controller');486         }487 488
// If $returned is a string, then the controller output something,489
       // probably a view, instead of echoing it directly. Send it
along

   3.

   SYSTEMPATH/CodeIgniter.php : 351   —  CodeIgniter\CodeIgniter->handleRequest
   ( arguments <https://ds50.dyanix.it:81/login?auth_check=2FACHECK#> )

   344 345         // spark command has nothing to do with HTTP
redirect and 404346         if ($this->isSparked()) {347
return $this->handleRequest($routes, $cacheConfig,
$returnResponse);348         }349 350         try {351
return $this->handleRequest($routes, $cacheConfig,
$returnResponse);352         } catch (RedirectException $e) {353
      $logger = Services::logger();354
$logger->info('REDIRECTED ROUTE at ' . $e->getMessage());355 356
      // If the route is a 'redirect' route, it throws357
// the exception with the $to as the message358
$this->response->redirect(base_url($e->getMessage()), 'auto',
$e->getCode());

   4.

   FCPATH/index.php : 68   —  CodeIgniter\CodeIgniter->run ()

   61  *---------------------------------------------------------------62
 * LAUNCH THE APPLICATION63
*---------------------------------------------------------------64  *
Now that everything is setup, it's time to actually fire65  * up the
engines and make this app do its thang.66  */67 68 $app->run();69






Thanks!
Janwillem


On Thu, Aug 22, 2024 at 7:14 PM Michael Stauber via Blueonyx <
blueonyx at mail.blueonyx.it> wrote:

> Hi Janwillem,
>
> > One of our 5211R doesn't allow me anymore to login into the GUI as admin.
> > After entering the 2FA code I get an "internal server error The server
> > encountered an internal error and was unable to complete your request."
> >
> > /var/log/secure shows:
> > Aug 22 16:51:48 ds50 cced(smd)[11928]: PAM unable to
> > dlopen(/usr/lib64/security/pam_cracklib.so):
> > /usr/lib64/security/pam_cracklib.so: cannot open shared object file: No
> > such file or directory
>
> You can ignore that pam_cracklib.so error as it has no relevance to your
> problem and doesn't affect logins.
>
> To see why you get "internal server error" in the GUI you could turn on
> GUI-debugging and that would help us to find the real cause of the problem:
>
> https://www.blueonyx.it/blueonyx-5211r-debugging
>
> > I do have SSH access
> > Any idea for a quick fix or how to enable 2fa temporarily from the
> > commandline?
> As "root" and from the shell run /usr/sausalito/bin/cceclient to fire up
> CCEClient:
>
> [root at server ~]# /usr/sausalito/bin/cceclient
> 100 CSCP/0.99
> 200 READY
>
> In there type:
>
> FIND System
>
> That will report back something like this:
>
> 104 OBJECT 1
>
> In this example it tells us that the 'System' Object has the OID #1.
>
> Then enter this:
>
> SET <OID> gui_2fa = "0"
>
> Replace <OID> with the Object ID that the "FIND System" command had
> reported back. In our case that was the number 1, so we'd use:
>
> SET 1 gui_2fa = "0"
>
> It will report back "201 OK" if the transaction was successful. And that
> then has set 2FA to disabled.
>
> Alternatively: You could run "rm -f ~admin/.google_authenticator" to
> remove the 2FA config file for user "admin". That would allow you to
> login to the GUI as "admin" (without 2FA) and then you could turn off
> 2FA via the GUI.
>
> --
> With best regards
>
> Michael Stauber
> _______________________________________________
> Blueonyx mailing list
> Blueonyx at mail.blueonyx.it
> http://mail.blueonyx.it/mailman/listinfo/blueonyx
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.blueonyx.it/pipermail/blueonyx/attachments/20240822/015de3c7/attachment-0001.html>


More information about the Blueonyx mailing list