Incorrect User or Password from GUI

[rds-r2d2]

We have changed the admin password to something other than the default but now after a period of time we are getting "Incorrect User or Password" when trying to login via the GUI.  A few times before this we getting logged in then kicked out immediately and I had to reboot the device to fix it. But now nothing seems to work. 

I can still login via the CLI with expedition user. Is there a way I can add an Expedition user or edit the admin account from the CLI?

[dgildelaig]

I can see that your log points out that the database is not available.

The users credentials are in the database, and if we do not have it running, it can't validate them.

The issue seems to be in the tc.log file. It may have got corrupted at some point (no big deal) and it can access it.

Try deleting the file

sudo rm -f /var/lib/mysql/tc.log

and afterwards, try starting mariadb again.

sudo service mysql start

Later, if MariaDB started correctly, just check if you can log into the GUI with your normal credentials. If it still fails, then try restorning the admin password with the CLI script

php /home/userSpace/utils/restore/restoreAdmin.php

[SARowe_NZ]

I've been getting this as well.

Your suggestion definitely allowed me to start MariaDB and log in to the GUI, thanks; but seems Expedition is corrupted "Remote Exception" with no additional detail as soon as I log in, and much of the dashboard and all of the Internal Checks is broken.

Thanks anyway, looks like I'll have to rebuilt.

[dgildelaig]

We could check the apache error logs to see if there is something more that we should check.

Could you check if you have errors in

/var/log/apache/error.log?

[tbowen]

Cannot login to Expedition GUI.  Have not changed the admin password.  The php script referenced to reset admin password from the cli does not exist in expedition (there is no "restore" directory).  I have run sudo apt-get install expedition-beta. Still cannot log in to gui as admin with default password. I've restarted the browser and have also tried "sudo service mysql restart.  Still cannot login to gui as admin with default password.

[Stevenjwilliams83]

Check the space on your box. df -h

[tbowen]

Thanks for the suggestion.

/ has usage percentage at 27%

/boot has usage percentage at 36%

/run has usage percentage at 2%

all the rest are at 0% usage

trying to update to version1.1.38 to resolve bug MT-1225 - Log processing - failed due to memory issues

[dgildelaig]

Have you performed an apt-get upgrade?

If so, now some Expedition dependencies are broken, and it won't work.

If you are unsure, check the logs in 

/var/log/apache2/error.log

just after attempting a login. If you see new lines referring to a PDO error, I am quite sure that you have upgraded packages that broke dependencies.

Unfortunately, if this is the case, you will need to reinstall expedition.

Remember: DO NOT upgrade Expedition. It is provided to run with the packages that are supported. If you decide to upgrade the packages, we cannot provide support for it.

If this is not the case, contact us to fwmigrate at paloaltonetworks dot com.

[achrist_2019]

Same issue here. Any ideas? Can we save the projects folder?

[dgildelaig]

Not currently.

The data we have in the /home/userSpace/projects is encrypted and saving it into a new Expedition wouldn't be enough as the new Expedition wouldn't have the keys to retrieve the information.

[will.coquillette]

For me in April 2020, I was able to restore the credentials "admin // paloalto" for Expedition GUI (WebUI) with this:

php /var/www/html/OS/startup/restore/restoreAdmin.php

[Stephane_Samba]

I solved this issue restarting mysql service with this command line : "service mysql restart". I can't find the log files about HTTPS connections to Expedition. Even if I tried to refresh some legacy debug files from Linux..