[Starlingx-discuss] <BLOCKING> StarlingX 2.0 Account Locked for User

Sun, Yicheng (Jerry) Jerry.Sun at windriver.com
Mon Nov 25 20:52:44 UTC 2019


Hi All,

Looking at the tarball for the logs attached by Peng, it looks like after the password was changed in bash.log, there is no more activity from registry-token-server in daemon.log. This leads me to believe that something else must be triggering the locking of the account. There are some activity from token server in daemon.log but that was before the password change.

I also tried authenticating to the token server with incorrect credentials on a system without changing the password. This is to try and create an environment where the registry/token server holds incorrect keystone credentials. The admin account did not get locked which means token server does not spam requests at keystone with incorrect credentials until it locks.

Thanks,
Jerry 

-----Original Message-----
From: Andy Ning <andy.ning at windriver.com> 
Sent: Monday, November 25, 2019 11:05 AM
To: starlingx-discuss at lists.starlingx.io
Subject: Re: [Starlingx-discuss] <BLOCKING> StarlingX 2.0 Account Locked for User



On 2019-11-25 12:00 AM, Yong Hu wrote:
> Hi Anirudh,
>
> This issue is similar to this LP#1853017 [0], which was triggered the 
> account locking if the password of Openstack user "admin" was changed.
> In this LP, for unknown reason, "registry-token-server" daemon kept 
> accessing "keystone" on host (not the instance in containers) with 
> obsolete token and led to "admin" account locked after 5 attempts.
>
If registry token server keeps on accessing keystone with obsolete token, this could be a bug in the token server. Normally if a keystone client get a failed authentication, it should try to retrieve a new token by using username/password.

Andy

> Right now, I am debugging this issue.
> Good thing is Cengn build 11/16 seemed not to have such a problem 
> (LP#1853017).
>
> You might have a try with this version?
> BTW: which cengn build were you using?
>
>
> [0] https://bugs.launchpad.net/starlingx/+bug/1853017
>
> regards,
> Yong
>
> On 2019/11/19 6:06 PM, Anirudh Gupta wrote:
>> Hi Team,
>>
>> I have installed StarlingX 2.0 Duplex Bare Metal.
>>
>> I am trying to create 2 VM’s and repeating this cycle a number of times.
>>
>> After using the setup for around half and hour, I am not longer able 
>> to access the GUI.
>>
>> Ever though I type correct Username/Password, it gives an error of 
>> Invalid Credentials.
>>
>> Then, I thought to use the CLI commands by following LOAD CLI section 
>> given in link
>>
>> https://docs.starlingx.io/deploy_install_guides/r2_release/openstack/
>> access.html#local-cli
>>
>>
>> But with this also, I am facing the same error
>>
>> controller-0:~$ export OS_CLOUD=openstack_helm
>>
>> controller-0:~$ openstack endpoint list
>>
>> The account is locked for user: 230578cde382430a8adac399afab1230. 
>> (HTTP 401) (Request-ID: req-6da6d59a-2edd-4f2b-a8bf-f13f2e423a77)
>>
>> Earlier this automatically started working after 5-7 mins.
>>
>> But this time, I am completely Blocked.
>>
>> I have also raised a bug regarding the same
>>
>> https://bugs.launchpad.net/starlingx/+bug/1853093
>>
>> Please suggest some pointers, so that I can unblock and resume my 
>> activities.
>>
>> Regards
>>
>> Anirudh Gupta
>>
>> DISCLAIMER: This electronic message and all of its contents, contains 
>> information which is privileged, confidential or otherwise protected 
>> from disclosure. The information contained in this electronic mail 
>> transmission is intended for use only by the individual or entity to 
>> which it is addressed. If you are not the intended recipient or may 
>> have received this electronic mail transmission in error, please 
>> notify the sender immediately and delete / destroy all copies of this 
>> electronic mail transmission without disclosing, copying, 
>> distributing, forwarding, printing or retaining any part of it.
>> Hughes Systique accepts no responsibility for loss or damage arising 
>> from the use of the information transmitted by this email including 
>> damage from virus.
>>
>> _______________________________________________
>> Starlingx-discuss mailing list
>> Starlingx-discuss at lists.starlingx.io
>> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
>>
>
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss

--
Andy Ning
Cube: 3071
Tel: 613-9631408 (int: 4408)
Skype: andy.ning.wr


_______________________________________________
Starlingx-discuss mailing list
Starlingx-discuss at lists.starlingx.io
http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss


More information about the Starlingx-discuss mailing list