search

Ylianst / MeshCentral

A complete web-based remote monitoring and management web site. Once setup you can install agents and perform remote desktop session to devices on the local network or over the Internet.
https://meshcentral.com
Apache License 2.0
4.26k stars 571 forks source link

LDAP Authentication Inconsistent Failure #6407

Open baclaeys opened 1 month ago

baclaeys commented 1 month ago

Describe the bug I have been using LDAP authentication for more than a year now. About a month ago LDAP authentication would periodically stop working. No changes were made to the config.json during this time. I have resorted to using local authentication by commenting out "_auth": "ldap" in the config.json file, but I would like to go back to LDAP authentication.

To Reproduce Steps to reproduce the behavior: At the sign in screen enter your shortname and password. Click on "Log In". Sometimes it will accept the credentials, and sometimes it will not. I also built out two additional servers to test this problem (details listed below). They also had the same issue with LDAP authentication.

Test server 1:

Test Server 2:

Expected behavior LDAP authentication should be successful if the correct username (shortname) and password is entered.

Screenshots If applicable, add screenshots to help explain your problem. image

The log file shows the exact same thing as the screenshot. Here is an excerpt from auth.log:

Sep 17 16:31:59 meshcentral http[2041296]: Server listening on 0.0.0.0 port 80.
Sep 17 16:32:3 meshcentral https[2041296]: Server listening on 0.0.0.0 port 443.
Sep 17 16:36:9 meshcentral http[2042162]: Server listening on 0.0.0.0 port 80.
Sep 17 16:36:13 meshcentral https[2042162]: Server listening on 0.0.0.0 port 443.
Sep 17 16:36:23 meshcentral https[2042162]: Accepted password for claeys.bc from 143.22.31.90 port 27424
Sep 17 16:40:35 meshcentral https[2042162]: User Brian Claeys logout from 143.22.31.90 port 28156
Sep 17 16:40:43 meshcentral https[2042162]: Accepted password for claeys.bc from 143.22.31.90 port 28167
Sep 17 16:49:44 meshcentral https[2042162]: User Brian Claeys logout from 143.22.31.90 port 29801
Sep 17 16:49:51 meshcentral https[2042162]: Accepted password for claeys.bc from 143.22.31.90 port 29809
Sep 17 16:50:41 meshcentral https[2042162]: Accepted password for thomas.bc from 137.179.31.117 port 61942
Sep 17 16:59:8 meshcentral http[2046446]: Server listening on 0.0.0.0 port 80.
Sep 17 16:59:11 meshcentral https[2046446]: Server listening on 0.0.0.0 port 443.
Sep 17 16:59:24 meshcentral https[2046446]: Failed password for claeys.bc from 143.22.31.90 port 31442
Sep 17 17:08:19 meshcentral https[2046446]: Failed password for claeys.bc from 143.22.31.90 port 32786
Sep 17 17:08:36 meshcentral https[2046446]: Failed password for claeys.bc from 143.22.31.90 port 32830
Sep 17 17:09:17 meshcentral http[2048376]: Server listening on 0.0.0.0 port 80.
Sep 17 17:09:21 meshcentral https[2048376]: Server listening on 0.0.0.0 port 443.

Server Software (please complete the following information):

Client Device (please complete the following information):

Remote Device (please complete the following information):

Additional context Restarting meshcentral.service can sometimes seem to resolve the issue, but I think there is something else that I am missing. I tested logging into all three servers at the same time with LDAP authentication turned on. So far they would all succeed or fail all the same. I am not sure if this is a coincidence.

Your config.json file

The config file below has "_auth": "ldap" commented out to allow for local authentication.

{
  "__comment__" : "This is a sample configuration file, edit a section and remove the _ in front of the name. Refer to the user's guide for details.",
"settings": {
    "_Cert": "myserver.mydomain.com",
    "_MongoDb": "mongodb://127.0.0.1:27017",
    "_MongoDbName": "meshcentral",
    "_MongoDbChangeStream": true,
    "_WANonly": true,
    "_LANonly": true,
    "_Minify": 1,
    "_SessionTime": 30,
    "_SessionKey": "MyReallySecretPassword1",
    "_SessionSameSite": "strict",
    "_DbEncryptKey": "MyReallySecretPassword2",
    "_DbRecordsEncryptKey": "MyReallySecretPassword",
    "_DbRecordsDecryptKey": "MyReallySecretPassword",
    "_DbExpire": {
      "events": 1728000,
      "powerevents": 864000
    },
    "_Port": 443,
    "_RedirPort": 80,
    "_AllowLoginToken": true,
    "_AllowFraming": true,
    "_WebRTC": false,
    "_Nice404": false,
    "_ClickOnce": false,
    "_SelfUpdate": true,
    "_AgentPing": 60,
    "_AgentPong": 60,
    "_AgentIdleTimeout": 150,
    "MeshErrorLogPath": "/home/lnxadmin/meshcentral-logs/",
    "_NpmPath": "c:\\npm.exe",
    "NpmProxy": "http://104.129.198.34:9400",
    "AllowHighQualityDesktop": true,
    "_UserAllowedIP": "127.0.0.1,192.168.1.0/24",
    "_UserBlockedIP": "127.0.0.1,::1,192.168.0.100",
    "_AgentAllowedIP": "192.168.0.100/24",
    "_AgentBlockedIP": "127.0.0.1,::1",
    "AuthLog": "/home/lnxadmin/meshcentral-logs/auth.log",
    "_LocalDiscovery": {
      "name": "Local server name",
      "info": "Information about this server"
    },
    "_TlsOffload": true,
    "_MpsPort": 44330,
    "_MpsAliasPort": 4433,
    "_MpsAliasHost": "mps.mydomain.com",
    "_MpsTlsOffload": true,
    "_No2FactorAuth": true,
    "Log": [
        "cookie",
        "dispatch",
        "main",
        "peer",
        "web",
        "webrequest",
        "relay",
        "webrelaydata",
        "webrelay",
        "mps",
        "mpscmd",
        "swarm",
        "swarmcmd",
        "agentupdate",
        "agent",
        "cert",
        "db",
        "email",
        "amt",
        "httpheaders",
        "websocket"
    ],
    "_WebRtConfig": {
      "iceServers": [
        { "urls": "stun:stun.services.mozilla.com" },
        { "urls": "stun:stun.l.google.com:19302" }
      ]
    },
    "AutoBackup": {
      "backupIntervalHours": 24,
      "keepLastDaysBackup": 10,
      "zipPassword": "MyReallySecretPassword3",
      "_backupPath": "C:\\backups"
    },
    "_Redirects": {
      "meshcommander": "https://www.meshcommander.com/"
    },
    "__MaxInvalidLogin": "Time in minutes, max amount of bad logins from a source IP in the time before logins are rejected.",
    "MaxInvalidLogin": { "time": 10, "count": 10, "coolofftime": 10 },
    "Plugins": {
        "enabled": true, "proxy":"http://znaproxy.na.pg.com:9400/"
    }
  },
  "domains": {
    "": {
      "_auth": "ldap",
      "ldapUserName": "displayName",
      "ldapUserBinaryKey": "objectSid",
      "ldapOptions": {
        "url": "ldap://143.22.31.14:389",
        "bindDN": "CN=ic-oxidized,OU=Users,OU=Iowa City,OU=Sites,DC=cis,DC=pg,DC=com",
        "bindCredentials": "obfuscated",
        "ldapUserRequiredGroupMembership": [ "CN='meshcentralusers',OU=Users,OU=Iowa City,OU=Sites,DC=cis,DC=pg,DC=com" ],
        "ldapSyncWithUserGroups": { "filter": [ "CN='meshcentralusers',OU=Users,OU=Iowa City,OU=Sites,DC=cis,DC=pg,DC=com" ] },
        "_ldapUserRequiredGroupMembership": [ "CN='digiconusers',OU=Users,OU=Iowa City,OU=Sites,DC=cis,DC=pg,DC=com" ],
        "_ldapSyncWithUserGroups": { "filter": [ "CN='digiconusers',OU=Users,OU=Iowa City,OU=Sites,DC=cis,DC=pg,DC=com" ] },
        "_ldapUserRequiredGroupMembership": [ "CN='Digicon Users',OU=Users,OU=Iowa City,OU=Sites,DC=cis,DC=pg,DC=com" ],
        "_ldapSyncWithUserGroups": { "filter": [ "CN='Digicon Users',OU=Users,OU=Iowa City,OU=Sites,DC=cis,DC=pg,DC=com" ] },
        "_searchBase": "CN=digiconusers,OU=Users,OU=Iowa City,OU=Sites,DC=cis,DC=pg,DC=com",
        "searchBase": "OU=Users,OU=Iowa City,OU=Sites,DC=cis,DC=pg,DC=com",
        "_searchFilter": "(name={{username}})",
        "searchFilter": "(sAMAccountName={{username}})",
        "_LDAPSiteAdminGroups": "CN='meshcentralusers',OU=Users,OU=Iowa City,OU=Sites,DC=cis,DC=pg,DC=com"
      },
      "Title": "Digicon Remote Management",
      "Title2": "Iowa City Beauty",
      "_TitlePicture": "title-sample.png",
      "_UserQuota": 1048576,
      "_MeshQuota": 248576,
      "_NewAccounts": true,
      "_UserNameIsEmail": true,
      "_NewAccountEmailDomains": [ "sample.com" ],
      "_NewAccountsRights": [ "nonewgroups", "notools" ],
      "_ManageAllDeviceGroups": [ "admin" ],
      "Footer": "<a href='https://twitter.com/mytwitter'>Twitter</a>",
      "_CertUrl": "https://192.168.2.106:443/",
      "_PasswordRequirements": { "min": 8, "max": 128, "upper": 1, "lower": 1, "numeric": 1, "nonalpha": 1, "reset": 90, "force2factor": true, "skip2factor": "127.0.0.1,192.168.2.0/24" },
      "_AgentNoProxy": true,
      "_GeoLocation": true,
      "_UserAllowedIP": "127.0.0.1,192.168.1.0/24",
      "_UserBlockedIP": "127.0.0.1,::1,192.168.0.100",
      "_AgentAllowedIP": "192.168.0.100/24",
      "_AgentBlockedIP": "127.0.0.1,::1",
      "___UserSessionIdleTimeout__" : "Number of user idle minutes before auto-disconnect",
      "_UserSessionIdleTimeout" : 30,
      "__UserConsentFlags__" : "Set to: 1 for desktop, 2 for terminal, 3 for files, 7 for all",
      "_UserConsentFlags" : 7,
      "_Limits": {
        "_MaxDevices": 100,
        "_MaxUserAccounts": 100,
        "_MaxUserSessions": 100,
        "_MaxAgentSessions": 100,
        "MaxSingleUserSessions": 10
      },
      "_AmtAcmActivation": {
        "log": "amtactivation.log",
        "certs": {
          "mycertname": {
            "certfiles": [ "amtacm-leafcert.crt", "amtacm-intermediate1.crt", "amtacm-intermediate2.crt", "amtacm-rootcert.crt" ],
            "keyfile": "amtacm-leafcert.key"
          }
        }
      },
      "_Redirects": {
        "meshcommander": "https://www.meshcommander.com/"
      },
      "_yubikey": { "id": "0000", "secret": "xxxxxxxxxxxxxxxxxxxxx", "_proxy": "http://myproxy.domain.com:80" },
      "_httpheaders": {
        "Strict-Transport-Security": "max-age=360000",
        "x-frame-options": "SAMEORIGIN",
        "Content-Security-Policy": "default-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-src 'self'; media-src 'self'"
      },
      "_agentConfig": [ "webSocketMaskOverride=1" ],
      "_SessionRecording": {
        "_filepath": "C:\\temp",
        "_index": true,
        "__protocols__": "Is an array: 1 = Terminal, 2 = Desktop, 5 = Files, 100 = Intel AMT WSMAN, 101 = Intel AMT Redirection",
        "protocols": [ 1, 2, 101 ]
      }
    },
    "_customer1": {
      "_DNS": "customer1.myserver.com",
      "_Title": "Customer1",
      "_Title2": "TestServer",
      "_NewAccounts": 1,
      "_Auth": "sspi",
      "_Footer": "Test",
      "_CertUrl": "https://192.168.2.106:443/"
    },
    "_info": {
      "_share": "C:\\ExtraWebSite"
    }
  },
  "_letsencrypt": {
    "__comment__": "Requires NodeJS 10.12 or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
    "email": "myemail@myserver.com",
    "names": "myserver.com,customer1.myserver.com",
    "rsaKeySize": 3072,
    "production": false
  },
  "_peers": {
    "serverId": "server1",
    "servers": {
      "server1": { "url": "wss://192.168.2.133:443/" },
      "server2": { "url": "wss://192.168.1.106:443/" }
    }
  },
  "_smtp": {
    "host": "smtp.myserver.com",
    "port": 25,
    "from": "myemail@myserver.com",
    "__tls__": "When 'tls' is set to true, TLS is used immidiatly when connecting. For SMTP servers that use TLSSTART, set this to 'false' and TLS will still be used.",
    "tls": false,
    "___tlscertcheck__": "When set to false, the TLS certificate of the SMTP server is not checked.",
    "_tlscertcheck": false,
    "__tlsstrict__": "When set to true, TLS cypher setup is more limited, SSLv2 and SSLv3 are not allowed.",
    "_tlsstrict": true
  }
}
si458 commented 1 month ago

have you tried updating to the latest version of meshcentral as this does have some LDAP improvements? you are running 1.1.0 and the latest is 1.1.30

edit: you will also need node 16 or above now too

baclaeys commented 1 month ago

have you tried updating to the latest version of meshcentral as this does have some LDAP improvements? you are running 1.1.0 and the latest is 1.1.30

edit: you will also need node 16 or above now too

I have tried using the latest version, but it did it then as well. It is a production environment, so I was hoping to stick with the stable release. I just tried using a new bind user account. I will post an update on how that goes after some testing.

si458 commented 1 month ago

the only thing i can think of that looks abit weird is CN='meshcentralusers',OU=Users,OU=Iowa City,OU=Sites,DC=cis,DC=pg,DC=com i dont think the CN should have ' around them?

one other thing you could try is run the server in debug mode and watch the ldap logins (requires a restart of your meshcentral sadly) node node_modules/meshcentral --debug ldap,authlog OR below inside your config.json (still requires a restart)

{
  "settings": {
    "debug": "ldap,authlog"
  },
  ...
}
LeonardoIdalgo commented 1 month ago

Hello, I've recently been having the same issue. I'm unable to configure the LDAP for my MeshCentral.

C:\meshcentral\node_modules>node meshcentral --debug ldap,authlog MeshCentral HTTP redirection server running on port 80. AUTHLOG: Server listening on 0.0.0.0 port 80. MeshCentral v1.1.31, LAN mode. MeshCentral HTTPS server running on port 443. AUTHLOG: Failed password for leonardXXX.XXXxx from 192.XX.5.XX port 26997, Browser: Edge/129.0.0.0, OS: Windows/10 I’m not sure what I’m doing wrong.

"_customer1": { 
    "_dns": "xxxxx.sxxpxxx.br", 
    "_title": "INxxx", 
    "_title2": "Remote", 
    "_newAccounts": 1, 
    "auth": "ldap", 
    "_LDAPUserName": "gecos", 
    "_LDAPUserKey": "uid", 
    "_LDAPUserEmail": "otherMail", 
    "_LDAPUserGroups": "memberOf", 
    "_LDAPSiteAdminGroups": [ 
        "CN=TxxxxxxC,OU=IxxxxxxR,DC=mxxxxi,DC=xx,DC=xxx" 
    ], 
    "_LDAPUserRequiredGroupMembership": [ 
        "CN=Txxxxxxx,OU=INxxxxxR,DC=mxxxxx,DC=xx,DC=xxx" 
    ], 
    "_LDAPSyncWithUserGroups": { 
        "filter": [ 
            "CN=xxxxxxx,OU=Ixxxxx,DC=mxxxxxi,DC=xx,DC=xxx,DC=xx" 
        ] 
    }, 
    "_LDAPOptions": { 
        "URL": "ldap://dxxxxxxxxxx:636", 
        "BindDN": "CN=LEONAxxxxxx xxxxx,OU=xxxxxx,OU=xxxxxxxxxTICA,OU=xxxxxxL PExxxxRA,OU=CxxxxTO HOxxxxxLxxx xxxxxxx,DC=xxxxxxx,DC=xx,DC=xxx,DC=xx", 
        "BindCredentials": "xxxxxxxx*", 
        "SearchBase": "DC=xxxxxx,DC=xx,DC=xxx,DC=xx", 
        "SearchFilter": "(sAMAccountName={{username}})", 
        "tlsOptions": { 
            "rejectUnauthorized": false 
        } 
    } 
}

Let me know if you need any further assistance!

si458 commented 1 month ago

@LeonardoIdalgo all your values have an underscore infront of them. Any values in your config.json that start with an underscore are ignored! So remove the underscore, restart and away you go!

LeonardoIdalgo commented 1 month ago

I can't believe I was making such a basic mistake. Thank you so much for your help, I'll test it and let you know.

LeonardoIdalgo commented 1 month ago

Good afternoon, I'm still having trouble configuring LDAP in my MeshCentral. I tested the same credentials I used to access LDAP in LDAP Soft, and I was also able to make queries using:

powershell

Creating a directory object

$ldapConnection = New-Object System.DirectoryServices.DirectorySearcher $ldapConnection.SearchRoot = [ADSI]"LDAP://$($ldapServer):$($ldapPort)" $ldapConnection.Filter = "(cn=$groupName)" # Filter to search for the group

Defining the scope and properties to load

$ldapConnection.SearchScope = [System.DirectoryServices.SearchScope]::Subtree $ldapConnection.PropertiesToLoad.Add("cn") Using PowerShell, I was able to establish a connection to check if LDAP is active and successfully perform queries as well.

But when I input the information below into MeshCentral, it doesn't connect. This situation is really frustrating for me.

`

"customer1": {
  "dns": "hidden",
  "title": "INxxxT",
  "title2": "Remote",
  "NewAccounts": 1,
  "auth": "ldap",
  "LDAPUserName": "gecos",
  "LDAPUserKey": "sAMAccountName",
  "LDAPUserEmail": "otherMail",
  "LDAPUserGroups": "memberOf",
  "LDAPSiteAdminGroups": [ "CN=TxxxxC,OU=IxxxxxxR,DC=mxxxxi,DC=xx,DC=gxx,DC=xx" ],
  "LDAPUserRequiredGroupMembership": [ "CN=xxxxxxC,OU=IxxxxxxER,DC=mxxxxqui,DC=xx,DC=xxx,DC=xx" ],
  "LDAPSyncWithUserGroups": { "filter": [ "CN=xxxxxxxIC" ] },
  "LDAPOptions": {
    "URL": "ldap://XXXXXXXXX:636",
    "BindDN": "CN=LEONARDO XXXXXX IDxLXO,OU=USUARIOS,OU=XXXXXXXXX TICA,OU=XXXXXX PXXXXXRA,OU=CXXXXX HXXXXXXX MXXXXXXXXX,DC=xxxxxxxi,DC=xxxx,DC=xxx,DC=xx",
    "BindCredentials": "HIdden*",
    "SearchBase": "DC=xxxxxxi,DC=xx,DC=xx,DC=xx",
    "SearchFilter": "(sAMAccountName={{username}})"
  }

`

C:\meshcentral\node_modules>node meshcentral --debug ldap,authlog MeshCentral HTTP redirection server running on port 80. AUTHLOG: Server listening on 0.0.0.0 port 80. MeshCentral v1.1.31, Hybrid (LAN + WAN) mode. MeshCentral Intel(R) AMT server running on xxxxxx. AUTHLOG: Server listening on 0.0.0.0 port xxxx. MeshCentral HTTPS server running on xxxxxxxxx:443. AUTHLOG: Failed password for leonardo.idxxlgo from xxxxxxx port 26280, Browser: Edge/129.0.0.0, OS: Windows/10 AUTHLOG: Failed password for MxxxxxxxI\leonardo.idxxlgo from 19x.xxx.xxx.xx port 2xx26, Browser: Edge/129.0.0.0, OS: Windows/10 AUTHLOG: Failed password for leonardo.idalgo@mxxxxxxx.xx.xxx.xx from 19xxxxxxx port 2xx49, Browser: Edge/129.0.0.0, OS: Windows/10

si458 commented 1 month ago

I think ur BindDN is incorrect as it has spaces in it! Use something like LDAP Admin to explore ur ldap and check the cn value fir that user But also ur cn for the usergroup u want users to have access too

If ur struggling, u can always email myself and I can help look into it so long as u can provide access someway sumhow to ur environment so I can debug ut

LeonardoIdalgo commented 1 month ago

Good evening, what's your email? I'm a bit new here on GitHub.

Could you help me with this? I believe I can't proceed right now since I would need authorization from my manager to connect to my environment. For the moment, I'm trying to resolve this on my own.

I got my Bind DN directly from my user’s Distinguished Name, and the structure has already been created with spaces. I was able to connect easily to my LDAP using the same credentials in LDAP Soft. I think the issue might be that JSON doesn’t handle spaces or even the º symbol in Informática.

Here’s my Bind DN:

makefile Copiar código CN=LEONARDO VXXXXXE IDALGO,OU=USUARIOS,OU=1º - INFORMATICA,OU=MXXXXL PXXXRA,OU=COXXXXXXO HOXXXXXR MXXXXXXI,DC=mxxxxxx,DC=xx,DC=xxx,DC=xx Any insights would be greatly appreciated!

si458 commented 1 month ago

My email is on my github profile page. But yes the is a possibility the json and ldap doesn't like those special symbols! One way of proving this is create a group without spaces and a user without special characters

baclaeys commented 1 month ago

the only thing i can think of that looks abit weird is CN='meshcentralusers',OU=Users,OU=Iowa City,OU=Sites,DC=cis,DC=pg,DC=com i dont think the CN should have ' around them?

one other thing you could try is run the server in debug mode and watch the ldap logins (requires a restart of your meshcentral sadly) node node_modules/meshcentral --debug ldap,authlog OR below inside your config.json (still requires a restart)

{
  "settings": {
    "debug": "ldap,authlog"
  },
  ...
}

Thank you for sharing the debug configuration. After testing for a few days with a new bind user account I have had no other issues with LDAP authentication. I am not sure what the issue was/is with that other user account. It would still be nice to find the root issue, but I do not which direction to go to troubleshoot. Perhaps this is not the place for that issues.