pfSense CE 2.9.0 upgrade: LDAP logins now timeout
-
I can't find mention of this anywhere - apologies if I've missed it and this is a repeat.
Since upgrading our systems from 2.8.1 to 2.9.0 admin logins time out within 60 seconds or so - but only where the user is LDAP via an external AD server. Fortunately the local admin account is fine. I've tried explicitly setting the session timeout rather than leaving it blank to default to default to 240 minutes, but that has no effect. I've no entry in Auth Refresh Time.
This is repeatable across a number of systems. No issues prior to the upgrade.
I don't know if it affects pfSense+ as our installs of that are in AWS and they can't reach our on-prem AD servers so are restricted to local admin account anyway.
-
I should perhaps add: this is happening across a variety of hardware, from an old Lenovo laptop to an ESXi VM. None of them are short of CPU/RAM resources. All were probably originally built as 2.7.4.
I can't post the relevant bits of XML as it's being flagged as spam.
-
There are some recent LDAP-related Redmines you should try to dig up.
-
Hmm, curious. Is anything logged in pfSense when the user gets logged out? Anything unexpected at least?
-
@stephenw10 Ah, just successful logins in the authentication log, but in the system log I see the following about a minute after logging in using LDAP...
Sep 8 15:12:19 php-fpm 90613 /index.php: Successful login for user '[redacted username] from: [redacted IP] (LDAP/[redacted AD server name]) Sep 8 15:13:26 php-fpm 24818 ERROR [LDAP Auth] ldap_get_groups() could not bind to server [redacted AD server name].We've not observed any issues with the binding account or connectivity to the AD server for any other systems, or with any of our pfSense installations prior to the upgrade to 2.9.0, but I'll see if I can get some monitoring in place.
I might have 'fixed' it by entering a large value for Auth Refresh Time - perhaps something has changed there between versions. I'm constantly distracted by higher priority issues (not with pfSense!) but will report back if I can get something a little more definite...
-
Little bit further on... logging in to the shell and running an ldap search against the domain controller, LDAP works, but LDAPS fails, with a certificate fault -
[2.9.0-RELEASE][admin@[redacted]]/root: ldapsearch -H ldaps://[redacted] -D "CN=[redacted],DC=uk" -w $pass -b "dc=ad,[redacted],dc=uk" -s sub "(sn=smith)" givenName ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) additional info: error:0A000086:SSL routines::certificate verify failed (unable to get local issuer certificate)CA & certs look good to me (internal PKI in use) but I'll dig deeper. Meanwhile, it's curious that the login process actually works, but a check after authentication cache expires then fails.
-
Fixed it.
I use PKI to create a certificate authority (root and two intermediates) to validate the LDAPS server, and when I imported the CA I did not enable Add this certificate authority to the operating system trust store - it's a quick fix to just edit the CA and tick that box - now I'm not getting logins timing out, and from the shell I can use ldapsearch to query the domain controller using both LDAPS and LDAP.
So, not a bug, but a change that's exposed an error I've been making for a decade. Still, it's strange the way it's surfaced, with the initial login being fine and then failing later, and only on 2.9.0!
Thanks for the pointers folks! :-) Hopefully this might help someone else in the event that they see the same issues.
-
Hmm, interesting. I would try to restart php from the console menu and see if that changes anything. The LDAP PHP module has done some unexpected things in the past.
-
Glad to find this; I had the same problem after the upgrade and the fix worked for me as well. Thanks for sharing!
-
@whosmatt excellent - glad it helped, and happy to know I'm not the only one who experienced this!
Privacy Policy · Cookie Policy