[Bug?] Sophos UTM forgets Bind DN password

RE: [Bug?] Sophos UTM forgets Bind DN password

BAlfson — Wed, 04 Dec 2019 17:51:55 GMT

It sounds like you should get a case open with Sophos Support.

The next time you get an invalid response, please post a picture of what you see including the Server definition.

Cheers - Bob

RE: [Bug?] Sophos UTM forgets Bind DN password

Kevin Murphy2 — Wed, 04 Dec 2019 17:32:45 GMT

Yes it is correct. And the AD server queries are working from checking the logs. Its just confusing when troubleshooting an issue to have it tell you that the credentials are invalid when they are not.

RE: [Bug?] Sophos UTM forgets Bind DN password

BAlfson — Tue, 03 Dec 2019 22:51:56 GMT

Hi Kevin and welcome to the UTM Community!

When checking a user doesn't work, try the following as root at the command line:

cc get_objects authentication adirectory |grep bind_pw

That will show you in clear text what the UTM thinks is the password. Is it correct?

Cheers - Bob

RE: [Bug?] Sophos UTM forgets Bind DN password

Kevin Murphy2 — Mon, 02 Dec 2019 17:11:00 GMT

I know this is an old thread now but I am experiencing exactly the same behaviour in release 9.605-1 Wonder if there has been a regression in a later release? I have tried deleting and re-entering the entire server entry. When I initially enter the username and password and click test, I get a successful connection but once I click save and then go back into it and click test, I get unable to bind with this username or password. Its frustrating as I am trying to troubleshoot SSO and HTTPS proxy and I am unsure whether the AD backend is actually working correctly or not.

RE: [Bug?] Sophos UTM forgets Bind DN password

BAlfson — Wed, 12 Apr 2017 16:35:42 GMT

Thanks, Asad - in fact, the dsquery is used in my KnowledgeBase article Configuring HTTP/S proxy access with AD SSO.

Cheers - Bob

RE: [Bug?] Sophos UTM forgets Bind DN password

AsadulHasan — Wed, 12 Apr 2017 16:02:38 GMT

Hello Bob,

Actually it always worked, in case your test connectivity is getting failed with CN=A,DC=B and DC=C you can go to the Windows power shell on the domain controller and run the command as C:\Users\Administrator> dsquery user

It will show you correct bind DN for each user and you can simply copy and paste the Bind DN into UTM for the required user and it works fine.

However you can also go with second approach as abc@xyz.local

-Asad

RE: [Bug?] Sophos UTM forgets Bind DN password

BAlfson — Thu, 16 Mar 2017 11:26:37 GMT

Hi, Asad, and welcome to the UTM Community! Nice to have another participant from Sophos.

Interesting - do we know when this was added, or has it always worked?

Cheers - Bob

RE: [Bug?] Sophos UTM forgets Bind DN password

AsadulHasan — Wed, 15 Mar 2017 06:52:05 GMT

CORRECTION

@Oliver: You can try with Bind DN as administrator@blue.local instead of CN=ADMINISTRATOR,DC=BLUE,DC=LOCAL

RE: [Bug?] Sophos UTM forgets Bind DN password

AsadulHasan — Wed, 15 Mar 2017 06:43:41 GMT

@Oliver: You can try with Bind DN as administrator@blue.local instead of CN=BLUE,DC=BLUE,DC=LOCAL

RE: [Bug?] Sophos UTM forgets Bind DN password

Oliver Yüzer — Tue, 21 Feb 2017 08:07:19 GMT

Now I finally managed to connect to the authentication server. I'm not sure if this was really the issue but however; this is what I've done:

Our Active Directory Servers are Windows Server 2016 with Security Compliance Manager (SCM) Baselines for Windows Server 2016 Domain Controllers. These baseline policies enforce LDAP server signing (Computer Configuration --> Policies --> Windows Settings --> Security Settings --> Local Policies --> Security Options --> Domain Controller: LDAP server signing requirements - Require signing)

So I changed the authenticaton server in UTM to use SSL and the port to 636. Now I can connect to the authentication server.

RE: [Bug?] Sophos UTM forgets Bind DN password

candal02 — Thu, 09 Feb 2017 10:28:57 GMT

Interestingly enough, the latest release 9.411-3 seems to have the same "fix" that was in release 9.410-6 (see snip below taken from 9.411-3 release notes). Not sure why that is. Maybe 9.411-3 is an amalgamation of 9.410-6 and a few other bug fixes. That would seem likely, as my UTM running 9.409-9 doesn't even see 9.410-6 as an update. I can only upgrade straight to 9.411-3 Anyway, maybe you can try upgrading to see if this release helps? Please know I don't work for Sophos. I'm only reporting what I see in the release notes. Hope this works out for you soon.

Fix [NUTM-6356]: [WebAdmin] AD User Test fails after first creation of an authentication server

RE: [Bug?] Sophos UTM forgets Bind DN password

CharlieOsborne — Sun, 05 Feb 2017 20:37:16 GMT

I can confirm that 9.410-6 has fixed this issue for me on the handful of UTMs I have tested this morning.

I did not have to recreate the authentication server entry either.

RE: [Bug?] Sophos UTM forgets Bind DN password

Oliver Yüzer — Fri, 03 Feb 2017 07:32:46 GMT

Updated to 9.410-6. Problem is still unsolved.

It's quite annoying since we have plenty users remotely connecting from outside. Now I had to create a local login inside the UTM for every user instead of using the AD users. Plus guiding every user trough the process of downloading and installing the remote connection tool again.

RE: [Bug?] Sophos UTM forgets Bind DN password

candal02 — Thu, 02 Feb 2017 07:32:09 GMT

Firmware version 9.410-6 was very recently released. In the release notes, one of the bug fixes (see snip below) may resolve this problem. Maybe someone from Sophos can confirm?

Fix [NUTM-6356]: [WebAdmin] AD User Test fails after first creation of an authentication server

RE: [Bug?] Sophos UTM forgets Bind DN password

david behr — Thu, 02 Feb 2017 02:37:22 GMT

Same problem here. Version 9.409-9 and re-adding the server changes nothing.

RE: [Bug?] Sophos UTM forgets Bind DN password

candal02 — Fri, 20 Jan 2017 14:45:07 GMT

For what it's worth, I was running 9.408-4 (2 UTM's in HA) and was having this exact same problem. Yesterday I upgraded to 9.409-9 and the problem went away.

RE: [Bug?] Sophos UTM forgets Bind DN password

Oliver Yüzer — Thu, 19 Jan 2017 03:44:38 GMT

We've got 2 Sophos UTM 220 in HA mode. I ran into the exact same issue with 9.407-3. After updating to 9.409-9 the issue is still present.

I tried with a dedicated user with just "authenticated users" permission (which normally shoud be sufficient) and also with domain admin. I also deleted the authenticaton server object and recreated from scratch.

Still getting "Error: Server exists and accepts connections, but bind to ldap://xxx.xxx.xxx.xx:389 failed with this Bind DN and Password"

RE: [Bug?] Sophos UTM forgets Bind DN password

ThorstenSeiler — Wed, 18 Jan 2017 02:56:40 GMT

Hmm... have serveral Virtual Appliances as well as UTM's and SG's on various customers Sites.

We had the Issue with .408 but I can say it's gone on every Site with .409...

Have you deleted the AD-Server and recreated it from scratch? J.Rivett mentioned above, he had to recreate those entries as well...

RE: [Bug?] Sophos UTM forgets Bind DN password

CharlieOsborne — Tue, 17 Jan 2017 18:00:44 GMT

It is exactly as described in the OP. When editing the adirectory authentication server entry testing ANY account fails until you reenter the bind password then tests with valid accounts are successful until you hit save, after which all tests fail again.
When the tests fail and when actually trying to authenticate as an AD user in both cases the authentication log says: Bind failed for <Bind DN>.
The results are the same whether you use UPN or LDAP notation in the Bind DN.

ThorstenSeiler - Thanks for the response, Yes the Bind DN is a domain admin and the account is not locked out.
Edit: To be thorough I have tried multiple different accounts in the Bind DN all with the same results.

In case it's relevant this is a software appliance (as stated above running 9.409-9)
Edit: I have now also tested this on an SG125 hardware appliance also running 9.409-9 against a different AD with the exact same results. This issue has definitely NOT been resolved in the latest release.

RE: [Bug?] Sophos UTM forgets Bind DN password

ThorstenSeiler — Tue, 17 Jan 2017 03:31:43 GMT

Do you use a dedicated AD-User for authentication-requests against the AD?

Is maybe the User blocked in AD?

What happens when you use domain-admin credentials?

RE: [Bug?] Sophos UTM forgets Bind DN password

CharlieOsborne — Thu, 12 Jan 2017 01:45:00 GMT

This is still an issue for me on 9.409-9

Even after deleting and recreating the Active Directory entry in Authentication Services > Servers.

RE: [Bug?] Sophos UTM forgets Bind DN password

J.Rivett — Wed, 11 Jan 2017 16:53:25 GMT

I found the latest update did fix this problem for me, but I had to completely delete the existing AD server first from:

Definitions & Users > Authentication Services > Servers tab

Then once I re-added the server all was well.

Let me know if this helps you.

RE: [Bug?] Sophos UTM forgets Bind DN password

Sabry Salem — Wed, 11 Jan 2017 15:43:07 GMT

any updates about this case guys !!

this really annoying...

RE: [Bug?] Sophos UTM forgets Bind DN password

RaymondBarry — Wed, 28 Dec 2016 16:34:55 GMT

I am experiencing this bug even though my UTM is running the latest firmware, version 9.409-9. Hopefully this bug will be fixed with the next firmware update.

RE: [Bug?] Sophos UTM forgets Bind DN password

J.Janssens — Wed, 07 Dec 2016 02:27:37 GMT

I'm happy to see it's finally acknowledged that this is a bug.