Can't login to GUI
-
@stephenw10 said in Can't login to GUI:
Well running that phpshell script will set the dash back to the defaults if needed. Or you can roll back the config if you just added something to the dash.
I will try rebooting tomorrow
I have not touched anything at all on the dash, so
️Another issue is - what’s the best way to troubleshoot for users in similar situations. So far no answer yet
I must tell that today's exchange was useful
Thx guys!
-
Check the System and Webgui logs. Use the CLI if the webgui is not available at all.
-
@chudak said in Can't login to GUI:
what’s the best way to troubleshoot for users in similar situations.
As my signature : always start looking at the logs.
Don't care if the GUI or whatever isn't working : the logs are always (every system on the planet) here : /var/log/
Logs files are always great : the tell you when the system is happy, you'll learn to see what logs look like if all is well.
When things go downhill, you'll spot the new lines / messages and these tell you what is up. -
The system is back to normal without me doing anything today !!!
-
There is a GUI security feature that will lock the gui out under some attack conditions. It self locks for a specific time
-
@JonathanLee said in Can't login to GUI:
There is a GUI security feature that will lock the gui out under some attack conditions. It self locks for a specific time
Really? And where is it configured and how do I know it was invoked?
I did run multiple pings from other countries, so it could be treated as an attack, I guess.
-
If you fail to login 3 times from the same source IP it will get locked out by sshguard. When that happens you won't be able to connect at all. You won't see the login screen. What you're seeing is not that.
https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html#login-protection
-
@stephenw10 I learned that the hard way :)
-
@stephenw10 said in Can't login to GUI:
If you fail to login 3 times from the same source IP it will get locked out by sshguard. When that happens you won't be able to connect at all. You won't see the login screen. What you're seeing is not that.
https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html#login-protection
Does it expose any GUI level option?
thx it's great!
-
@chudak said in Can't login to GUI:
Does it expose any GUI level option?
Not sure what you're asking there?
There are tuning options for it in the GUI. You can whitelist IPs to prevent them being blocked.
-
@stephenw10 said in Can't login to GUI:
@chudak said in Can't login to GUI:
Does it expose any GUI level option?
Not sure what you're asking there?
There are tuning options for it in the GUI. You can whitelist IPs to prevent them being blocked.
Where please?
-
In Sys > Adv > Admin. As shown in that linked doc.
-
@chudak said in Can't login to GUI:
The system is back to normal without me doing anything today !!!
So you didn't do anything to fix it? Did you ever find a cause?
I just ran into what seems like the same thing, on one router. GUI log in succeeds ("... /index.php: Successful login for user 'admin' from...") but I can't get past the login page. I can log in via SSH.
I do not see anything useful in system.log or nginx.log, just normal logins and GET/POST. No failed login attempts that I see.
Edit: 24.03
Edit: trying direct URLs (/firewall_rules.php) still shows the login page -
Hmm. From multiple browsers and/or client devices?
-
@stephenw10 said in Can't login to GUI:
Hmm. From multiple browsers and/or client devices?
Well I tried it from a private window in Firefox, and also deleted site/URL cookies in the main window. It does work from Chrome though on my PC. Not sure how that is possible...
Also it works in Firefox if I use a FQDN name, like https://router-building.example.net, or IP address, instead of https://router-building, which I've used for 10+ years.
Edit: closing Firefox doesn't help.
-
Hmm, I've seen that if you have multiple firewalls resolving to the same IP. Like one behind the other with port forwards. You can only log into one at a time.
Not exactly what you describe though....
-
@stephenw10 No port forwarding in use here. There are two nested routers (office and building) but with unique IPs.
Given it is URL dependent, it smells like a cookie problem but a private window or deleting cookies should fix that. I have never seen a different browser work differently than a new private window.
Could there be something on the web server end that doesn't release for a while, yet survives a webconfigurator restart? (OP said it fixed itself overnight...)
-
Yup it sure does feel like a cookie issue...
-
Just for the record, today a Firefox private window lets me log in with the "short name" but the regular browser window still does not. So it changed behavior somewhat.
-
@SteveITS said in Can't login to GUI:
Just for the record, today a Firefox private window lets me log in with the "short name" but the regular browser window still does not. So it changed behavior somewhat.
Have you tried killing all associated states?
