topic Re: Can not access to Web Admin GUI on Active Device Paloalto, can access to Standby device in HA Sy in General Topics

Can not access to Web Admin GUI on Active Device Paloalto, can access to Standby device in HA System

Register_Security — Tue, 21 Mar 2017 07:42:52 GMT

Hi All,

I have met a problem with access to my Active Pan Device by Web Admin GUI.

I can access by SSH Console and I can access to Standby Device in HA System.

My device: PAN 3020, OS Version 6.1.4.

Have anyone meet the same problem, please share the solutions.

Error logs

---------------------

2017-03-21 11:04:21.009 +0700 Error: pan_authd_user_is_lockedout(pan_authd_localdb_utils.c:389): failed to prepare sql statement: select * from profiledb where vsysname=? and profilename=?
2017-03-21 11:04:21.012 +0700 Error: pan_auth_user_is_in_locklist(pan_authd_localdb_utils.c:177): failed to prepare sql statement: select * from locklist where vsysname=? and profilename=? and lower(username)=lower(?) and flags<>?
2017-03-21 11:04:21.013 +0700 Error: pan_auth_lock_user(pan_authd_localdb_utils.c:853): failed to lock user <shared,__dummy_%_admin_%_profile__,apiconfig>
2017-03-21 11:04:21.014 +0700 Error: pan_authd_user_auth_failure_alarm_gen(pan_authd_localdb_utils.c:663): failed to prepare sql statement: select * from profiledb where vsysname=? and profilename=?
2017-03-21 11:06:25.975 +0700 Error: pan_authd_handle_get_pwchange_required(pan_authd.c:3041): Failed in get_pwchange_required.
2017-03-21 11:06:26.082 +0700 Error: pan_auth_get_lastpwchange(pan_authd_localdb_utils.c:2943): Error in preparing sql statement.Could not access password history.
2017-03-21 11:06:26.082 +0700 Error: pan_auth_set_lastpwchange(pan_authd_localdb_utils.c:2994): Error getting lastpwchange for user:user1
2017-03-21 11:06:26.082 +0700 Error: pan_authd_handle_set_lastpwchange(pan_authd.c:2971): Failed to set lastpwchange.
2017-03-21 11:06:26.604 +0700 Error: pan_authd_admin_unlock_complete_handler(pan_authd_ops.c:482): failed to prepare sql statement: select * from authseqdb
2017-03-21 11:06:26.605 +0700 Error: cfgagent_doop_callback(pan_cfgagent.c:512): Failed to handle op command for agent:
2017-03-21 11:06:43.304 +0700 Error: pan_authd_admin_unlock_complete_handler(pan_authd_ops.c:482): failed to prepare sql statement: select * from authseqdb
2017-03-21 11:06:43.304 +0700 Error: cfgagent_doop_callback(pan_cfgagent.c:512): Failed to handle op command for agent:
2017-03-21 11:07:19.557 +0700 Error: pan_cfg_parse_authprofiles(pan_authd_ludb.c:1005): lockout time value missing
2017-03-21 11:07:19.558 +0700 Error: pan_cfg_parse_authprofiles(pan_authd_ludb.c:1005): lockout time value missing
2017-03-21 11:07:19.746 +0700 Error: pan_ludb_unmark_all(pan_authd_ludb.c:1640): failed to unmark rows in db: unable to open database file
2017-03-21 11:07:19.746 +0700 Error: pan_ludb_update_user_db(pan_authd_ludb.c:1764): failed to unmark rows in db
2017-03-21 11:07:19.747 +0700 Error: pan_ludb_update_profiledb(pan_authd_ludb.c:2189): failed to drop table in db: unable to open database file
2017-03-21 11:07:19.747 +0700 Error: pan_ludb_update_auth_db(pan_authd_ludb.c:3141): failed to update profile db
2017-03-21 11:07:19.747 +0700 Error: pan_ludb_update_adminuser_db(pan_authd_ludb.c:3075): failed to drop adminusers table in db: unable to open database file
2017-03-21 11:07:19.748 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for admin2017-03-21 11:07:19.748 +0700 debug: pan_cfg_set_ssh_auth_public_key(pan_cfg_utils.c:7497): Public key format = OpenSSH, type = RSA
2017-03-21 11:07:19.815 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for giangpd2017-03-21 11:07:19.816 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for apiconfig2017-03-21 11:07:19.816 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for xemconfig2017-03-21 11:07:19.816 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for xemreport2017-03-21 11:07:19.816 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for user12017-03-21 11:07:19.816 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for checkarp2017-03-21 11:07:19.816 +0700 Error: pan_ludb_update_ssh_authkey(pan_authd_ludb.c:3048): Could not set ssh-authentication public key for user12017-03-21 11:07:19.816 +0700 Error: pan_authd_remove_pwhistory(pan_authd_localdb_utils.c:3100): failed to remove all users from pwhistory
2017-03-21 11:07:19.816 +0700 Error: pan_authd_delete_expired_login_count(pan_authd_ludb.c:4092): Error delete login count from login history.Could not access login history.
---------------------

Thanks in advances.

Re: Can not access to Web Admin GUI on Active Device Paloalto, can access to Standby device in HA Sy

BPry — Tue, 21 Mar 2017 12:54:57 GMT

It looks like your account has been locked out for some reason. You could attempt to tail follow yes mp-log authd.log and see what it says for sure. I'm not positive if the sql statement errors are being generated because of a further pressing issue or if that is simply tied to the account being locked out.

Ps: Update your dang systems man! 6.1.4 is out of date even in the 6.1.* line!

Re: Can not access to Web Admin GUI on Active Device Paloalto, can access to Standby device in HA Sy

Register_Security — Wed, 22 Mar 2017 03:20:08 GMT

Hi BPry,

Thanks a lot your reponse.

"It looks like your account has been locked out for some reason." -> Yes, it's exprired by password profile (account not use in amount time).

But with the backup admin account (never exprired), I also not access to Web GUI with this account (only access to CLI).

Result of "tail follow yes mp-log authd.log" command, plz reivew it:

2017-03-22 10:04:20.832 +0700 Error: pan_auth_user_is_in_locklist(pan_authd_localdb_utils.c:177): failed to prepare sql statement: select * from locklist where vsysname=? and profilename=? and lower(username)=lower(?) and flags<>?
2017-03-22 10:04:20.833 +0700 Error: pan_auth_lock_user(pan_authd_localdb_utils.c:853): failed to lock user <shared,__dummy_%_admin_%_profile__,apiconfig>
2017-03-22 10:04:20.833 +0700 Error: pan_authd_user_auth_failure_alarm_gen(pan_authd_localdb_utils.c:695): failed to prepare sql statement: select * from locklist where vsysname=? and profilename=? and lower(username)=lower(?) and flags<>?
2017-03-22 10:04:20.833 +0700 debug: pan_authd_process_authresult(pan_authd.c:1399): Alarm generation set to: False.
2017-03-22 10:04:20.833 +0700 User 'abc' failed authentication. Reason: Invalid username/password From: 192.168.x.x.
2017-03-22 10:04:20.833 +0700 debug: pan_authd_generate_system_log(pan_authd.c:866): CC Enabled=False
2017-03-22 10:06:20.966 +0700 debug: pan_authd_service_req(pan_authd.c:3324): Authd:get group request
2017-03-22 10:06:20.966 +0700 debug: pan_authd_handle_group_req(pan_authd.c:3211): Got user role/adomain / for user xxx
2017-03-22 10:06:20.968 +0700 Error: pan_authd_inc_expired_login_count(pan_authd_ludb.c:3986): Error in binding username to sql statement.Could not access login history.
2017-03-22 10:06:20.968 +0700 Error: pan_authd_handle_group_req(pan_authd.c:3259): Failed to increment login count for xxx

Ps: Update your dang systems man! 6.1.4 is out of date even in the 6.1.* line! -> Thanks a lot for your remind, I will update asap ^_^