Authentication Issue about maltrail HOT 25 CLOSED

What browser? I had the same issue with one machine's firefox...starting a new, Private windows I was able to log in.

from maltrail.

I have to check how it performs on windows. Haven't tried for some time.

Which browser?

Bye
On Dec 15, 2015 9:54 PM, "Eric Fowler" [email protected] wrote:

Even when using the default password, the authentication does not work
properly. I've tried setting a new password for the admin account but the
submitted password never seems to match so I cannot view the user interface.

My suspicion is that it has to do with the server.py running on windows
for some reason. I've tried looking at the authentication code in httpd.py
but the main thing is that somewhere along there, the Session value never
gets set properly due to issues reading from the config file. The only
difference I really have is with the log paths being windows based ()
instead of unix based (/). Any thoughts on what might be causing the
authentication issue with the default setup?

—
Reply to this email directly or view it on GitHub
#10.

from maltrail.

I've been using chrome 47 in regular and private mode, it doesn't seem to auth at all. Haven't tried Firefox yet, but I'm not sure it's the browser because I can see in the main.js where the ajax call is made, a http status 401 is getting returned by the server.

from maltrail.

@ericfowler303 tried this moment with Firefox 43 and IE11 on Windows (both browser and maltrail's server on Windows OS). Authenticated successfully. Username: admin, password: changeme!

from maltrail.

@ericfowler303 have you changed anything in maltrail.conf? Particularly the USERS part

from maltrail.

@ericfowler303 with the latest revision both sensor and server run properly on Windows (though, with more setup).

p.s. this doesn't mean that you authentication issue is solved. Have you maybe forgot to put the character ! after the changeme ???

from maltrail.

@stamparm I sent my config file to your email that's listed on your
profile. Does that config work with you?

I've been using the ! In the password. Even after using the pbkf2 utility
to generate new passwords and after modifying that the auth wasn't working
then. I'll have to start the config again and see if the windows paths are
the issue or not.

On Tue, Dec 15, 2015, 3:26 PM Miroslav Stampar [email protected]
wrote:

@ericfowler303 https://github.com/ericfowler303 with the latest
revision both sensor and server run properly on Windows (though, with more
setup).

p.s. this doesn't mean that you authentication issue is solved. Have you
maybe forgot to put the character ! after the changeme ???

—
Reply to this email directly or view it on GitHub
#10 (comment).

from maltrail.

Yea it's kind of weird. I see the same type thing now...I see in syslog:

Dec 15 15:06:55 gateway maltrail[30277]: Accepted password for admin from 192.168.1.253 port 54668

But I'll just get sent back to the username/password combo.

from maltrail.

@ericfowler303 it seems that I am able to reproduce this behavior from your config. Will find, fix and let you know

from maltrail.

@ericfowler303 trick is in details. I would probably still bash my head trying to find what's going on. Thing is that I haven't expected (Windows) character \x0d in configuration file. Dummy bug

from maltrail.

Hi,
With Firefox I can't log in like others and in Chrome, I can log in however the page is loading during an infinite time

from maltrail.

@pierrehegr can you please go to the /var/log/maltrail, do the ls -la and report back the results?

from maltrail.

I have just this file 2015-12-17.log and inside, the result of the sensor (it's ok, the sensor is working great on my server)

from maltrail.

@pierrehegr I am always working in firefox, so its kind of strange that you get this kind of behavior. i am wondering how many events has sensor captured.

please do the ls -la /var/log/maltrail # i forgot to tell you to do the -la

from maltrail.

In Chrome, I have this message in the cmd:

Uncaught TypeError: Cannot read property 'substr' of null

And in Firefox, I can see that there is a: HTTP/1.1 401 Unauthorized error

from maltrail.

Here is the result:

-rw-r--r-- 1 root wheel 1312 Dec 17 05:41 2015-12-17.log

from maltrail.

@pierrehegr which line triggers the Uncaught TypeError: Cannot read property 'substr' of null?

from maltrail.

@pierrehegr or, better yet. you could send me the 2015-12-17.log to [email protected]

from maltrail.

This line is trigger when I do refresh the homepage. Ok, email send

from maltrail.

@pierrehegr Try firefox with private window/tab....that has worked for me, but after getting the latest git pull yesterday I was able without needing the private window/tab.

from maltrail.

Firefox 43.0 works very well :)

40,000 events :D

from maltrail.

@pierrehegr there is also one more thing that you could do:

1. set option SHOW_DEBUG true in maltrail.conf
2. rerun python server.py
3. try to connect again with browser
4. tell if you see anything in console (where server instance is running)

from maltrail.

And after rebooting and restarting, I am now having to use private tab again. I suspect this might be a cookie issue? Sending pcap....first session is normal firefox that fails, the next is private mode which works...creds are the same.

from maltrail.

@DigiAngel @pierrehegr @ericfowler303 my fault. I made a huge mistake in dealing with session cookies (more than one cookie caused this all hassle). With the latest revision this Login problem should be solved

from maltrail.

You do great work! Been working great since latest pull :)

from maltrail.