You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by "Devine, Harry (FAA)" <ha...@faa.gov.INVALID> on 2020/08/12 20:32:56 UTC
Really strange LDAP issue
I'm having a really strange LDAP issue on 1 of our Guacamole servers using LDAP. As far as I can tell, the LDAP is configured the same way (see below), and both machines can ping the LDAP Server by name, so its not a DNS issue. When we try to log in, we get:
Aug 12 16:28:27 tbfm-access server: 16:28:27.645 [http-bio-8080-exec-5] WARN o.a.g.r.auth.AuthenticationService - Authentication attempt from [10.143.37.157, 127.0.0.1] for user "harry.devine" failed.
The same account on the other guacamole server works:
Aug 12 16:29:19 tfdm-access server: 16:29:19.122 [http-bio-8080-exec-1118] INFO o.a.g.r.auth.AuthenticationService - User "harry.devine" successfully authenticated from [10.143.37.157, 127.0.0.1].
Here's the LDAP config for the server that works (v 1.1.0):
Guac1 (Does work): v 1.1.0
# LDAP Configuration
ldap-hostname:ldap.example.com
ldap-port:389
ldap-encryption-method:none
ldap-dereference-aliases:never
ldap-search-bind-dn:cn="Directory Manager"
ldap-search-bind-password:passwd
ldap-user-base-dn:cn=users,cn=accounts,dc=example,dc=com
ldap-username-attribute:uid
ldap-group-base-dn:cn=groups,cn=accounts,dc=example,dc=com
And for the one that doesn't work (v 1.0.0):
Guac2 (Does NOT work): v 1.0.0
#LDAP properties
ldap-hostname:ldap.example.com
ldap-port:389
ldap-encryption-method:none
ldap-dereference-aliases:never
ldap-search-bind-dn:cn="Directory Manager"
ldap-search-bind-password:passwd
ldap-user-base-dn:cn=users,cn=accounts,dc=example,dc=com
ldap-username-attribute:uid
ldap-group-base-dn:cn=groups,cn=accounts,dc=example,dc=com
Any ideas? Should I upgrade the 1.0.0 version to 1.2.0? If so, how, as I haven't been able to find clear instructions on what needs to be done to do this?
Thanks,
Harry
Harry Devine
DOT/FAA/AJM-2431
Secure-OSE Administrator
Red Hat Certified System Administrator (RHCSA)
harry.devine@faa.gov
(609)485-4218
Building 300, 3rd floor, Column L20 (3L20)
Re: Really strange LDAP issue
Posted by Mike Jumper <mj...@apache.org>.
I believe the Tomcat packages for CentOS and RHEL log primarily to the
systemd journal. If you check journalctl, you may be able to find
additional logs, assuming they haven't already been rotated away.
- Mike
On Fri, Aug 14, 2020 at 4:46 AM Devine, Harry (FAA)
<ha...@faa.gov.invalid> wrote:
> We are using RHEL 7.8 x64.
>
>
>
> *From:* Mike Jumper <mj...@apache.org>
> *Sent:* Thursday, August 13, 2020 2:00 PM
> *To:* user@guacamole.apache.org
> *Subject:* Re: Really strange LDAP issue
>
>
>
> What OS is Tomcat installed under? There may be additional logs elsewhere.
>
>
>
> - Mike
>
>
>
>
>
> On Thu, Aug 13, 2020, 04:55 Devine, Harry (FAA) <
> harry.devine@faa.gov.invalid> wrote:
>
> I see absolutely nothing. The catalina log is from yesterday
> (catalina.2020-08-12.log), but it has nothing in it about extensions. When
> I restart guacamole, no new log files get created under /var/log/tomcat at
> all.
>
>
>
> Harry
>
>
>
> *From:* Mike Jumper <mj...@apache.org>
> *Sent:* Wednesday, August 12, 2020 5:28 PM
> *To:* user@guacamole.apache.org
> *Subject:* Re: Really strange LDAP issue
>
>
>
> On Wed, Aug 12, 2020 at 1:33 PM Devine, Harry (FAA) <
> harry.devine@faa.gov.invalid> wrote:
>
> I’m having a really strange LDAP issue on 1 of our Guacamole servers using
> LDAP. As far as I can tell, the LDAP is configured the same way (see
> below), and both machines can ping the LDAP Server by name, so its not a
> DNS issue. When we try to log in, we get:
>
>
>
> Aug 12 16:28:27 tbfm-access server: 16:28:27.645 [http-bio-8080-exec-5]
> WARN o.a.g.r.auth.AuthenticationService - Authentication attempt from
> [10.143.37.157, 127.0.0.1] for user "harry.devine" failed.
>
>
>
> The same account on the other guacamole server works:
>
>
>
> Aug 12 16:29:19 tfdm-access server: 16:29:19.122 [http-bio-8080-exec-1118]
> INFO o.a.g.r.auth.AuthenticationService - User "harry.devine" successfully
> authenticated from [10.143.37.157, 127.0.0.1].
>
>
>
> What do you see in the Tomcat logs during Guacamole startup of both
> instances? There should be log messages from Guacamole noting the
> extensions loaded, the directory used for GUACAMOLE_HOME, and whether there
> were any errors loading those extensions.
>
>
>
> - Mike
>
>
>
>
Re: Really strange LDAP issue
Posted by Nick Couchman <vn...@apache.org>.
On Mon, Aug 17, 2020 at 8:56 AM Devine, Harry (FAA)
<ha...@faa.gov.invalid> wrote:
> Is this documented somewhere on the Guacamole site so I can follow it?
>
>
Yep!
http://guacamole.apache.org/doc/gug/jdbc-auth.html#idm45241640547568
-Nick
>
RE: Really strange LDAP issue
Posted by "Devine, Harry (FAA)" <ha...@faa.gov.INVALID>.
Is this documented somewhere on the Guacamole site so I can follow it?
Thanks,
Harry
From: Nick Couchman <vn...@apache.org>
Sent: Monday, August 17, 2020 8:35 AM
To: user@guacamole.apache.org
Subject: Re: Really strange LDAP issue
On Mon, Aug 17, 2020 at 8:16 AM Devine, Harry (FAA) <ha...@faa.gov.invalid>> wrote:
OK, I got it to work. I was able to download the 1.2.0 war file, put it where it needed to go, then I had to recompile the 1.2.0 server piece again, as guacd was still 1.0.0. After that everything was 1.2.0 and my LDAP user could log in.
So, with this sequence of events still in place, would it be safe to say that if I wanted to upgrade an older installation we have, which is 0.9.13-incubating, to 1.2.0, the above would be the best way to go about that? Recompile the server portion, update the WAR file, and restart guacd and tomcat?
If you're updating from 0.9.13-incubating and you're using the JDBC module you'll also need to update the database schema, as there are several changes in the 0.9.14 and 1.0.0 version.
-Nick
Re: Really strange LDAP issue
Posted by Nick Couchman <vn...@apache.org>.
On Mon, Aug 17, 2020 at 8:16 AM Devine, Harry (FAA)
<ha...@faa.gov.invalid> wrote:
> OK, I got it to work. I was able to download the 1.2.0 war file, put it
> where it needed to go, then I had to recompile the 1.2.0 server piece
> again, as guacd was still 1.0.0. After that everything was 1.2.0 and my
> LDAP user could log in.
>
>
>
> So, with this sequence of events still in place, would it be safe to say
> that if I wanted to upgrade an older installation we have, which is
> 0.9.13-incubating, to 1.2.0, the above would be the best way to go about
> that? Recompile the server portion, update the WAR file, and restart guacd
> and tomcat?
>
>
If you're updating from 0.9.13-incubating and you're using the JDBC module
you'll also need to update the database schema, as there are several
changes in the 0.9.14 and 1.0.0 version.
-Nick
>
RE: Really strange LDAP issue
Posted by "Devine, Harry (FAA)" <ha...@faa.gov.INVALID>.
OK, I got it to work. I was able to download the 1.2.0 war file, put it where it needed to go, then I had to recompile the 1.2.0 server piece again, as guacd was still 1.0.0. After that everything was 1.2.0 and my LDAP user could log in.
So, with this sequence of events still in place, would it be safe to say that if I wanted to upgrade an older installation we have, which is 0.9.13-incubating, to 1.2.0, the above would be the best way to go about that? Recompile the server portion, update the WAR file, and restart guacd and tomcat?
Thanks for everyone’s help!
Harry
From: Nick Couchman <vn...@apache.org>
Sent: Monday, August 17, 2020 7:56 AM
To: user@guacamole.apache.org
Subject: Re: Really strange LDAP issue
On Mon, Aug 17, 2020 at 7:50 AM Devine, Harry (FAA) <ha...@faa.gov.invalid>> wrote:
So late last week I tried to upgrade Guacamole from 1.0.0 to 1.2.0 to see if that helped. The version on the bottom right of the login page still says 1.0.0. After I restarted Tomcat, I see the following in /var/log/messages:
Aug 17 07:42:07 tbfm-access server: 07:42:07.270 [localhost-startStop-1] ERROR o.a.g.extension.ExtensionModule - Extension "guacamole-auth-jdbc-mysql-1.2.0.jar" could not be loaded: Extension "MySQL Authentication" is not compatible with this version of Guacamole.
Aug 17 07:42:07 tbfm-access server: 07:42:07.274 [localhost-startStop-1] ERROR o.a.g.extension.ExtensionModule - Extension "guacamole-auth-ldap-1.2.0.jar" could not be loaded: Extension "LDAP Authentication" is not compatible with this version of Guacamole.
Aug 17 07:42:07 tbfm-access server: 07:42:07.282 [localhost-startStop-1] INFO o.a.g.environment.LocalEnvironment - GUACAMOLE_HOME is "/usr/share/tomcat/.guacamole".
It looks like you got the new extension files in place, but the WAR file (which contains the core of the Guacamole Client) is the old version. You'll need to make sure you update the WAR file, too.
I have an Ansible role that installs Guacamole, and it appears as though the “upgrade” was only partial. So, my 3 choices are:
1) How to I make add the missing pieces so this installation is 1.2.0?
Make sure to update the WAR file.
2) Do I remove Guacamole completely and re-run the Ansible role to install as a new installation? If so, how?
This Ansible role is not something that I'm familiar with - it isn't something that is part of the Guacamole project - so I can't help much with that.
3) Do I just remove the VM completely and recreate it?
This should not be necessary, no - just need to make sure you get all the correct pieces updated, which seems to just be the WAR file at this point.
-Nick
Re: Really strange LDAP issue
Posted by Nick Couchman <vn...@apache.org>.
On Mon, Aug 17, 2020 at 7:50 AM Devine, Harry (FAA)
<ha...@faa.gov.invalid> wrote:
> So late last week I tried to upgrade Guacamole from 1.0.0 to 1.2.0 to see
> if that helped. The version on the bottom right of the login page still
> says 1.0.0. After I restarted Tomcat, I see the following in
> /var/log/messages:
>
>
>
> Aug 17 07:42:07 tbfm-access server: 07:42:07.270 [localhost-startStop-1]
> ERROR o.a.g.extension.ExtensionModule - Extension
> "guacamole-auth-jdbc-mysql-1.2.0.jar" could not be loaded: Extension "MySQL
> Authentication" is not compatible with this version of Guacamole.
>
> Aug 17 07:42:07 tbfm-access server: 07:42:07.274 [localhost-startStop-1]
> ERROR o.a.g.extension.ExtensionModule - Extension
> "guacamole-auth-ldap-1.2.0.jar" could not be loaded: Extension "LDAP
> Authentication" is not compatible with this version of Guacamole.
>
> Aug 17 07:42:07 tbfm-access server: 07:42:07.282 [localhost-startStop-1]
> INFO o.a.g.environment.LocalEnvironment - GUACAMOLE_HOME is
> "/usr/share/tomcat/.guacamole".
>
>
>
It looks like you got the new extension files in place, but the WAR file
(which contains the core of the Guacamole Client) is the old version.
You'll need to make sure you update the WAR file, too.
> I have an Ansible role that installs Guacamole, and it appears as though
> the “upgrade” was only partial. So, my 3 choices are:
>
>
>
> 1) How to I make add the missing pieces so this installation is
> 1.2.0?
>
Make sure to update the WAR file.
> 2) Do I remove Guacamole completely and re-run the Ansible role to
> install as a new installation? If so, how?
>
This Ansible role is not something that I'm familiar with - it isn't
something that is part of the Guacamole project - so I can't help much with
that.
> 3) Do I just remove the VM completely and recreate it?
>
This should not be necessary, no - just need to make sure you get all the
correct pieces updated, which seems to just be the WAR file at this point.
-Nick
>
RE: Really strange LDAP issue
Posted by "Devine, Harry (FAA)" <ha...@faa.gov.INVALID>.
So late last week I tried to upgrade Guacamole from 1.0.0 to 1.2.0 to see if that helped. The version on the bottom right of the login page still says 1.0.0. After I restarted Tomcat, I see the following in /var/log/messages:
Aug 17 07:42:07 tbfm-access server: 07:42:07.270 [localhost-startStop-1] ERROR o.a.g.extension.ExtensionModule - Extension "guacamole-auth-jdbc-mysql-1.2.0.jar" could not be loaded: Extension "MySQL Authentication" is not compatible with this version of Guacamole.
Aug 17 07:42:07 tbfm-access server: 07:42:07.274 [localhost-startStop-1] ERROR o.a.g.extension.ExtensionModule - Extension "guacamole-auth-ldap-1.2.0.jar" could not be loaded: Extension "LDAP Authentication" is not compatible with this version of Guacamole.
Aug 17 07:42:07 tbfm-access server: 07:42:07.282 [localhost-startStop-1] INFO o.a.g.environment.LocalEnvironment - GUACAMOLE_HOME is "/usr/share/tomcat/.guacamole".
I have an Ansible role that installs Guacamole, and it appears as though the “upgrade” was only partial. So, my 3 choices are:
1) How to I make add the missing pieces so this installation is 1.2.0?
2) Do I remove Guacamole completely and re-run the Ansible role to install as a new installation? If so, how?
3) Do I just remove the VM completely and recreate it?
Right now, #3 looks like the quickest route, but I wanted to give you guys an opportunity to comment on 1 or 2.
Thanks,
Harry
From: Nick Couchman <vn...@apache.org>
Sent: Sunday, August 16, 2020 1:45 PM
To: user@guacamole.apache.org
Subject: Re: Really strange LDAP issue
On Fri, Aug 14, 2020 at 10:54 AM Devine, Harry (FAA) <ha...@faa.gov.invalid>> wrote:
I copied the LDAP settings from /etc/guacamole/guacamole.properties on the machine that’s working and replaced it in the same file on the server that is not working, restarted guacd, and still get the same error. Still no update to catalina.out (it’s a 0 length file) in /var/log/tomcat. But I appreciated the response.
guacd does not deal with LDAP at all, so restarting guacd is not going to help you. You need to restart Tomcat, which is where Guacamole Client runs, and the piece that talks to LDAP.
Regarding the catalina.out file - if you're running the version of Tomcat included in the RHEL7 packages, then it may be just logging everything to syslog, which you can see with either "journalctl" or in the contents of /var/log/messages. If you've installed a custom version of Tomcat then the logs may be written elsewhere - for example, I usually install a newer version of Tomcat (9.x) and put it in /opt/tomcat. In my installation, the logs end up being written to /opt/tomcat/logs, with the most useful output written to catalina.out in that directory.
As a side note, and not really relevant to your current issue, Red Hat (= IBM) has chosen to discontinue including Tomcat in the latest version of RHEL, instead pushing people toward JBoss. While I know there has been some frustration expressed by people at that decision, they are so far behind on the version of Tomcat included with RHEL7, anyway, that I'm not sure it matters much. I think RHEL7 generally comes with an older 7.0 version of Tomcat, while the project has released many versions of 8.0, 8.5, and 9.0 in that time. At some point you'll probably want to just grab the latest Tomcat binaries from the project site and install them rather than relying on the ancient packages included with RHEL7, and which will not be included with RHEL8. Or, switch over to JBoss....although, that comes with its own baggage :-).
-Nick
Re: Really strange LDAP issue
Posted by Nick Couchman <vn...@apache.org>.
On Fri, Aug 14, 2020 at 10:54 AM Devine, Harry (FAA)
<ha...@faa.gov.invalid> wrote:
> I copied the LDAP settings from /etc/guacamole/guacamole.properties on the
> machine that’s working and replaced it in the same file on the server that
> is not working, restarted guacd, and still get the same error. Still no
> update to catalina.out (it’s a 0 length file) in /var/log/tomcat. But I
> appreciated the response.
>
>
>
guacd does not deal with LDAP at all, so restarting guacd is not going to
help you. You need to restart Tomcat, which is where Guacamole Client
runs, and the piece that talks to LDAP.
Regarding the catalina.out file - if you're running the version of Tomcat
included in the RHEL7 packages, then it may be just logging everything to
syslog, which you can see with either "journalctl" or in the contents of
/var/log/messages. If you've installed a custom version of Tomcat then the
logs may be written elsewhere - for example, I usually install a newer
version of Tomcat (9.x) and put it in /opt/tomcat. In my installation, the
logs end up being written to /opt/tomcat/logs, with the most useful output
written to catalina.out in that directory.
As a side note, and not really relevant to your current issue, Red Hat (=
IBM) has chosen to discontinue including Tomcat in the latest version of
RHEL, instead pushing people toward JBoss. While I know there has been some
frustration expressed by people at that decision, they are so far behind on
the version of Tomcat included with RHEL7, anyway, that I'm not sure it
matters much. I think RHEL7 generally comes with an older 7.0 version of
Tomcat, while the project has released many versions of 8.0, 8.5, and 9.0
in that time. At some point you'll probably want to just grab the latest
Tomcat binaries from the project site and install them rather than relying
on the ancient packages included with RHEL7, and which will not be included
with RHEL8. Or, switch over to JBoss....although, that comes with its own
baggage :-).
-Nick
>
RE: Really strange LDAP issue
Posted by "Devine, Harry (FAA)" <ha...@faa.gov.INVALID>.
I copied the LDAP settings from /etc/guacamole/guacamole.properties on the machine that’s working and replaced it in the same file on the server that is not working, restarted guacd, and still get the same error. Still no update to catalina.out (it’s a 0 length file) in /var/log/tomcat. But I appreciated the response.
Thanks,
Harry
From: Glauco Rampogna <gl...@gmail.com>
Sent: Friday, August 14, 2020 8:59 AM
To: user@guacamole.apache.org
Subject: Re: Really strange LDAP issue
Ii've had a similar issue with two twin servers.
In my case, it was caused by an illegal char in the config file.
I've discovered it with strace on guacd: it was an error 500, with json error "ldap-port must be an integer". Tomcat was in debug mode but this kind of message never appeared on the logs.
Don't know what char, i've manually rewritten everything to be sur, and it worked again.
Maybe it's unrelated, just for sharing.
Il ven 14 ago 2020, 13:46 Devine, Harry (FAA) <ha...@faa.gov.invalid>> ha scritto:
We are using RHEL 7.8 x64.
From: Mike Jumper <mj...@apache.org>>
Sent: Thursday, August 13, 2020 2:00 PM
To: user@guacamole.apache.org<ma...@guacamole.apache.org>
Subject: Re: Really strange LDAP issue
What OS is Tomcat installed under? There may be additional logs elsewhere.
- Mike
On Thu, Aug 13, 2020, 04:55 Devine, Harry (FAA) <ha...@faa.gov.invalid>> wrote:
I see absolutely nothing. The catalina log is from yesterday (catalina.2020-08-12.log), but it has nothing in it about extensions. When I restart guacamole, no new log files get created under /var/log/tomcat at all.
Harry
From: Mike Jumper <mj...@apache.org>>
Sent: Wednesday, August 12, 2020 5:28 PM
To: user@guacamole.apache.org<ma...@guacamole.apache.org>
Subject: Re: Really strange LDAP issue
On Wed, Aug 12, 2020 at 1:33 PM Devine, Harry (FAA) <ha...@faa.gov.invalid>> wrote:
I’m having a really strange LDAP issue on 1 of our Guacamole servers using LDAP. As far as I can tell, the LDAP is configured the same way (see below), and both machines can ping the LDAP Server by name, so its not a DNS issue. When we try to log in, we get:
Aug 12 16:28:27 tbfm-access server: 16:28:27.645 [http-bio-8080-exec-5] WARN o.a.g.r.auth.AuthenticationService - Authentication attempt from [10.143.37.157, 127.0.0.1] for user "harry.devine" failed.
The same account on the other guacamole server works:
Aug 12 16:29:19 tfdm-access server: 16:29:19.122 [http-bio-8080-exec-1118] INFO o.a.g.r.auth.AuthenticationService - User "harry.devine" successfully authenticated from [10.143.37.157, 127.0.0.1].
What do you see in the Tomcat logs during Guacamole startup of both instances? There should be log messages from Guacamole noting the extensions loaded, the directory used for GUACAMOLE_HOME, and whether there were any errors loading those extensions.
- Mike
Re: Really strange LDAP issue
Posted by Glauco Rampogna <gl...@gmail.com>.
Ii've had a similar issue with two twin servers.
In my case, it was caused by an illegal char in the config file.
I've discovered it with strace on guacd: it was an error 500, with json
error "ldap-port must be an integer". Tomcat was in debug mode but this
kind of message never appeared on the logs.
Don't know what char, i've manually rewritten everything to be sur, and it
worked again.
Maybe it's unrelated, just for sharing.
Il ven 14 ago 2020, 13:46 Devine, Harry (FAA) <ha...@faa.gov.invalid>
ha scritto:
> We are using RHEL 7.8 x64.
>
>
>
> *From:* Mike Jumper <mj...@apache.org>
> *Sent:* Thursday, August 13, 2020 2:00 PM
> *To:* user@guacamole.apache.org
> *Subject:* Re: Really strange LDAP issue
>
>
>
> What OS is Tomcat installed under? There may be additional logs elsewhere.
>
>
>
> - Mike
>
>
>
>
>
> On Thu, Aug 13, 2020, 04:55 Devine, Harry (FAA) <
> harry.devine@faa.gov.invalid> wrote:
>
> I see absolutely nothing. The catalina log is from yesterday
> (catalina.2020-08-12.log), but it has nothing in it about extensions. When
> I restart guacamole, no new log files get created under /var/log/tomcat at
> all.
>
>
>
> Harry
>
>
>
> *From:* Mike Jumper <mj...@apache.org>
> *Sent:* Wednesday, August 12, 2020 5:28 PM
> *To:* user@guacamole.apache.org
> *Subject:* Re: Really strange LDAP issue
>
>
>
> On Wed, Aug 12, 2020 at 1:33 PM Devine, Harry (FAA) <
> harry.devine@faa.gov.invalid> wrote:
>
> I’m having a really strange LDAP issue on 1 of our Guacamole servers using
> LDAP. As far as I can tell, the LDAP is configured the same way (see
> below), and both machines can ping the LDAP Server by name, so its not a
> DNS issue. When we try to log in, we get:
>
>
>
> Aug 12 16:28:27 tbfm-access server: 16:28:27.645 [http-bio-8080-exec-5]
> WARN o.a.g.r.auth.AuthenticationService - Authentication attempt from
> [10.143.37.157, 127.0.0.1] for user "harry.devine" failed.
>
>
>
> The same account on the other guacamole server works:
>
>
>
> Aug 12 16:29:19 tfdm-access server: 16:29:19.122 [http-bio-8080-exec-1118]
> INFO o.a.g.r.auth.AuthenticationService - User "harry.devine" successfully
> authenticated from [10.143.37.157, 127.0.0.1].
>
>
>
> What do you see in the Tomcat logs during Guacamole startup of both
> instances? There should be log messages from Guacamole noting the
> extensions loaded, the directory used for GUACAMOLE_HOME, and whether there
> were any errors loading those extensions.
>
>
>
> - Mike
>
>
>
>
RE: Really strange LDAP issue
Posted by "Devine, Harry (FAA)" <ha...@faa.gov.INVALID>.
We are using RHEL 7.8 x64.
From: Mike Jumper <mj...@apache.org>
Sent: Thursday, August 13, 2020 2:00 PM
To: user@guacamole.apache.org
Subject: Re: Really strange LDAP issue
What OS is Tomcat installed under? There may be additional logs elsewhere.
- Mike
On Thu, Aug 13, 2020, 04:55 Devine, Harry (FAA) <ha...@faa.gov.invalid>> wrote:
I see absolutely nothing. The catalina log is from yesterday (catalina.2020-08-12.log), but it has nothing in it about extensions. When I restart guacamole, no new log files get created under /var/log/tomcat at all.
Harry
From: Mike Jumper <mj...@apache.org>>
Sent: Wednesday, August 12, 2020 5:28 PM
To: user@guacamole.apache.org<ma...@guacamole.apache.org>
Subject: Re: Really strange LDAP issue
On Wed, Aug 12, 2020 at 1:33 PM Devine, Harry (FAA) <ha...@faa.gov.invalid>> wrote:
I’m having a really strange LDAP issue on 1 of our Guacamole servers using LDAP. As far as I can tell, the LDAP is configured the same way (see below), and both machines can ping the LDAP Server by name, so its not a DNS issue. When we try to log in, we get:
Aug 12 16:28:27 tbfm-access server: 16:28:27.645 [http-bio-8080-exec-5] WARN o.a.g.r.auth.AuthenticationService - Authentication attempt from [10.143.37.157, 127.0.0.1] for user "harry.devine" failed.
The same account on the other guacamole server works:
Aug 12 16:29:19 tfdm-access server: 16:29:19.122 [http-bio-8080-exec-1118] INFO o.a.g.r.auth.AuthenticationService - User "harry.devine" successfully authenticated from [10.143.37.157, 127.0.0.1].
What do you see in the Tomcat logs during Guacamole startup of both instances? There should be log messages from Guacamole noting the extensions loaded, the directory used for GUACAMOLE_HOME, and whether there were any errors loading those extensions.
- Mike
Re: Really strange LDAP issue
Posted by Mike Jumper <mj...@apache.org>.
What OS is Tomcat installed under? There may be additional logs elsewhere.
- Mike
On Thu, Aug 13, 2020, 04:55 Devine, Harry (FAA)
<ha...@faa.gov.invalid> wrote:
> I see absolutely nothing. The catalina log is from yesterday
> (catalina.2020-08-12.log), but it has nothing in it about extensions. When
> I restart guacamole, no new log files get created under /var/log/tomcat at
> all.
>
>
>
> Harry
>
>
>
> *From:* Mike Jumper <mj...@apache.org>
> *Sent:* Wednesday, August 12, 2020 5:28 PM
> *To:* user@guacamole.apache.org
> *Subject:* Re: Really strange LDAP issue
>
>
>
> On Wed, Aug 12, 2020 at 1:33 PM Devine, Harry (FAA) <
> harry.devine@faa.gov.invalid> wrote:
>
> I’m having a really strange LDAP issue on 1 of our Guacamole servers using
> LDAP. As far as I can tell, the LDAP is configured the same way (see
> below), and both machines can ping the LDAP Server by name, so its not a
> DNS issue. When we try to log in, we get:
>
>
>
> Aug 12 16:28:27 tbfm-access server: 16:28:27.645 [http-bio-8080-exec-5]
> WARN o.a.g.r.auth.AuthenticationService - Authentication attempt from
> [10.143.37.157, 127.0.0.1] for user "harry.devine" failed.
>
>
>
> The same account on the other guacamole server works:
>
>
>
> Aug 12 16:29:19 tfdm-access server: 16:29:19.122 [http-bio-8080-exec-1118]
> INFO o.a.g.r.auth.AuthenticationService - User "harry.devine" successfully
> authenticated from [10.143.37.157, 127.0.0.1].
>
>
>
> What do you see in the Tomcat logs during Guacamole startup of both
> instances? There should be log messages from Guacamole noting the
> extensions loaded, the directory used for GUACAMOLE_HOME, and whether there
> were any errors loading those extensions.
>
>
>
> - Mike
>
>
>
RE: Really strange LDAP issue
Posted by "Devine, Harry (FAA)" <ha...@faa.gov.INVALID>.
I see absolutely nothing. The catalina log is from yesterday (catalina.2020-08-12.log), but it has nothing in it about extensions. When I restart guacamole, no new log files get created under /var/log/tomcat at all.
Harry
From: Mike Jumper <mj...@apache.org>
Sent: Wednesday, August 12, 2020 5:28 PM
To: user@guacamole.apache.org
Subject: Re: Really strange LDAP issue
On Wed, Aug 12, 2020 at 1:33 PM Devine, Harry (FAA) <ha...@faa.gov.invalid>> wrote:
I’m having a really strange LDAP issue on 1 of our Guacamole servers using LDAP. As far as I can tell, the LDAP is configured the same way (see below), and both machines can ping the LDAP Server by name, so its not a DNS issue. When we try to log in, we get:
Aug 12 16:28:27 tbfm-access server: 16:28:27.645 [http-bio-8080-exec-5] WARN o.a.g.r.auth.AuthenticationService - Authentication attempt from [10.143.37.157, 127.0.0.1] for user "harry.devine" failed.
The same account on the other guacamole server works:
Aug 12 16:29:19 tfdm-access server: 16:29:19.122 [http-bio-8080-exec-1118] INFO o.a.g.r.auth.AuthenticationService - User "harry.devine" successfully authenticated from [10.143.37.157, 127.0.0.1].
What do you see in the Tomcat logs during Guacamole startup of both instances? There should be log messages from Guacamole noting the extensions loaded, the directory used for GUACAMOLE_HOME, and whether there were any errors loading those extensions.
- Mike
Re: Really strange LDAP issue
Posted by Mike Jumper <mj...@apache.org>.
On Wed, Aug 12, 2020 at 1:33 PM Devine, Harry (FAA)
<ha...@faa.gov.invalid> wrote:
> I’m having a really strange LDAP issue on 1 of our Guacamole servers using
> LDAP. As far as I can tell, the LDAP is configured the same way (see
> below), and both machines can ping the LDAP Server by name, so its not a
> DNS issue. When we try to log in, we get:
>
>
>
> Aug 12 16:28:27 tbfm-access server: 16:28:27.645 [http-bio-8080-exec-5]
> WARN o.a.g.r.auth.AuthenticationService - Authentication attempt from
> [10.143.37.157, 127.0.0.1] for user "harry.devine" failed.
>
>
>
> The same account on the other guacamole server works:
>
>
>
> Aug 12 16:29:19 tfdm-access server: 16:29:19.122 [http-bio-8080-exec-1118]
> INFO o.a.g.r.auth.AuthenticationService - User "harry.devine" successfully
> authenticated from [10.143.37.157, 127.0.0.1].
>
What do you see in the Tomcat logs during Guacamole startup of both
instances? There should be log messages from Guacamole noting the
extensions loaded, the directory used for GUACAMOLE_HOME, and whether there
were any errors loading those extensions.
- Mike
Re: Really strange LDAP issue
Posted by Sven Specker <sp...@rz.uni-frankfurt.de>.
Hi!
Having read the thread, I see that you say you have neither changed
anything in the guacamole config nor anything in the tomcat config?
If that is the case, I have a few more ideas that you could try.
1. What java version does the tomcat use? Is it different if you compare
Server 1 and Server 2? My own LDAP-Libraries barfed at first when I
switched from Java 8 to 11. And the errors were very odd. If server 1
runs java 8 and server 2 runs 11, let both run 8.
2. Is selinux off or on? Set it identically. Behaviour can change if the
OS-Level of both servers differs. And a pox on selinux! The amount of
debugging and voodoo I have seen in conjunction with this abomination of
a software is incredible. Look in the selinux logs if you are paranoid.
3. If the target LDAP-Server is a real LDAP-Server (like openLDAP or the
like) and not an AD, you should also check the ldap-Logs.
"Authentication failed" could be an abstraction of the error, the
library catches (no idea which ldap-lib guacamole uses). Some seem to
wrap all failures (no matter if it is "no such object", "TLS required"
etc.) into a super error which you have to disect to find out what
really happened. The log will tell you the error number and thus the
problem with the attempt.
4. Use a locally installed Version of tomcat 8.5.x/9.x. As already
mentioned, the version shipped with centos/rhel is horrible. One of the
few pacakges I always maintain manually in a REPO of my own. I am
running all my guacamole instances on 8.5.x.
Best regards,
Sven Specker
--
__________________________________________________________________
*** Sven Specker -- University of Frankfurt Computing Center ***
*********** UNIX System Administration (Auth/IDM) ****************
***** specker@rz.uni-frankfurt.de [Phone (+49)-69-798-15188] *****
******************************************************************
__________________________________________________________________
Johann Wolfgang Goethe Universitaet
- Hochschulrechenzentrum -
Theodor W. Adorno-Platz 1 (PA-1P16)
D-60323 Frankfurt/Main
__________________________________________________________________
______________ TeX-users do it in {groups}________________________