Can't log in via Web GUI; SSH root login is fine; How to fix?

[kiwieater]

Hi there,

I'm facing a weird login problem on one of my OPNsense installations, running on a PCengines APU:

  - As user root, I can no longer log into the device using the web GUI. Each time I try, all I get is a red warning saying "Wrong username or password."
  - When I was still able to use the Web GUI a while ago, I placed my SSH Pubkey on the box for root, so I can log in very comfortably as root using SSH.

Using menu option 8 (Shell) I reset root's password usign 'passwd' to something super simple and restarted the box. Yet still I can't log into the box. Is there a way to fix this from the root shell?

BTW: I'm on the 21.7.5 release, which I think is the latest:

# opnsense-version
OPNsense 21.7.5 (amd64/OpenSSL)

Best,
KiwiEater

[chemlud]

Can you login with another user into the GUI? So is the GUI listening on the respective interface at all? Try from LAN (first interface configured), if you havn't changed it, you should be able to login there...

[kiwieater]

Hi there,

I did not set up any other users on that device so far. Anyway, will try. And yes, the Web-GUI ist listening (Login page appears at leat).

Best,
KiwiEater

[kiwieater]

Hi there again,

I added another temporary user with adduser. Again, with a simple password. No luck: this user also can't login via Web UI.

Best
KiwiEater

[franco]

Using menu option 8 (Shell) I reset root's password usign 'passwd' to something super simple and restarted the box. Yet still I can't log into the box. Is there a way to fix this from the root shell?

Good luck, we do plug into PAM to go to our authentication system so that won't help.

Instead, try console option 3 (Password Reset).


Cheers,
Franco

[kiwieater]

Thanks! That did the trick.

Did not dare this before, as the statement "The root user login behaviour will be restored to its defaults" could mean that any present authorized_keys would also be wiped away and my access would then be completely lost.

However: The SSH key survived   

All good.

Best,
KiwiEater

[franco]

Wording is a bit strong, but also reliably fixes the login issue not touching anything other than the password and the main authentication server setting. 


Cheers,
Franco