This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[solved]Stuck Webadmin access

Hi All

I am having a strange problem and I would need your help. For some reason, I am not able to access the webadmin via the internal network .I can see that the access is denied on the firewall (I have logged on for the webadmin access). I also haVE internet object as part of the allowed networks so I am fine accessing the box from the internet. Same setting were applied to user portal and I got the access back by removing the internet object and re adding it again

However, I can't do this for the webadmin access.Is there a way to perform this via SSH?

What I would like to do is remove the internet object from the webadmin allowed networks and re add it again

Thanks

This thread was automatically locked due to age.

Parents

0 wingman over 12 years ago

Hi Ingo

Let me try to respond to your questions. Please let me know if something is not clear

Q: What exactly are you doing (for example, enter "192.168.1.2:4444" into the browser address bar and hit enter

A: When I connect to https://: I get a blank screen and according to the FW log the access is being denied

I get a blank screen on my chrome/firefox browser (attached) -The server at 192.168.2.100 is taking too long to respond.

2012:02:11-10:45:08 ****** ulogd[5545]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60005" initf="eth1.10" srcmac="0:1e:c9:67:44:6d" dstmac="0:1a:8c:12:3d:bc" srcip="192.168.2.5" dstip="192.168.2.100" proto="6" length="48" tos="0x00" prec="0x00" ttl="128" srcport="61552" dstport="8443" tcpflags="SYN"

When using my iphone to connect via vpn (I am still unable to connect ) but I get the standard error message saying "safari could not open the page because the server stopped responding)

2012-02-12.log.gz:2012:02:12-15:35:35 **** ulogd[5442]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60005" initf="ppp0" srcip="10.242.5.1" dstip="192.168.2.100" proto="6" length="64" tos="0x00" prec="0x00" ttl="64" srcport="52640" dstport="8443" tcpflags="SYN"

Q: How exactly can you see that?
(for example, by logging in via SSH and using "less" on the packetfilter log?)

A: Firewall log when connecting from the internet (I am only able to connect via the internet to my ASG)

Q:I don't understand that sentence at all.What exactly did you do?

A: I am able to login to my ASG via internet and perform any troubleshooting required.

Q:This is confusing. Did you have a problem with the user portal too?
Which one, exactly? How exactly was it resolved? Why do you think the two are related? Note that the node and object structure of access control to both services are very different.

A: I had the same problem in the sense that I wasn't able to login to user portal as well (user portal had the same allowed networks as webadmin). The issue was resolved by logging in to webadmin using the internet and navigate to the user portal configuration ,remove the internet object and re add it (on the allowed networks for user portal that is)

Q:Yes, basically anything can be done via SSH and cc.
but what you suggest would merely be a workaround.
Let's try to figure out the actual problem first, before trying random workarounds that might help or not (or just hide the problem, if any).


A: Couldn't agree more [[:)]]

Q:No, you are just looking in the wrong place.


A: no comment [[:)]]

Q:Instead, try
# cc get_object_by_name role role SUPERADMIN 


****:/root # cc get_object_by_name role role SUPERADMIN
get_object_by_name returned {
          'autoname' => 0,
          'class' => 'role',
          'data' => {
                      'comment' => 'This role grants unlimited WebAdmin access.',
                      'members' => [
                                     'REF_rEDbGHyHrY',
                                     'REF_DefaultSuperAdminGroup'
                                   ],
                      'name' => 'SUPERADMIN',
                      'rights' => [],
                      'webadmin_access' => 1
                    },
          'hidden' => 0,
          'lock' => '',
          'nodel' => 'global',
          'ref' => 'REF_SuperadminRole',
          'type' => 'role'
        }

Q:Hum, that's not the default configuration, indeed.Somebody deleted or moved (as in: changed the REF string) of the "admin" user object, it seems.

A: Admin user was deleted since not in use.  I use "wingman" account to connect to the box 

 Q:As which user? admin?

Try:

# cc get_user_by_name admin

But the most important question might be:
What does

# cc get webadmin allowed_networks

tell you?


****:/root # cc get_user_by_name admin
get_user_by_name returned 0

****:/root # cc get webadmin allowed_networks
webadmin->allowed_networks = [
          "REF_DefaultInternalNetwork",

Reply

0 wingman over 12 years ago

Hi Ingo

Let me try to respond to your questions. Please let me know if something is not clear

Q: What exactly are you doing (for example, enter "192.168.1.2:4444" into the browser address bar and hit enter

Q: How exactly can you see that?
(for example, by logging in via SSH and using "less" on the packetfilter log?)

A: Firewall log when connecting from the internet (I am only able to connect via the internet to my ASG)

Q:I don't understand that sentence at all.What exactly did you do?

A: I am able to login to my ASG via internet and perform any troubleshooting required.

Q:This is confusing. Did you have a problem with the user portal too?
Which one, exactly? How exactly was it resolved? Why do you think the two are related? Note that the node and object structure of access control to both services are very different.

A: I had the same problem in the sense that I wasn't able to login to user portal as well (user portal had the same allowed networks as webadmin). The issue was resolved by logging in to webadmin using the internet and navigate to the user portal configuration ,remove the internet object and re add it (on the allowed networks for user portal that is)

Q:Yes, basically anything can be done via SSH and cc.
but what you suggest would merely be a workaround.
Let's try to figure out the actual problem first, before trying random workarounds that might help or not (or just hide the problem, if any).


A: Couldn't agree more [[:)]]

Q:No, you are just looking in the wrong place.


A: no comment [[:)]]

Q:Instead, try
# cc get_object_by_name role role SUPERADMIN 


****:/root # cc get_object_by_name role role SUPERADMIN
get_object_by_name returned {
          'autoname' => 0,
          'class' => 'role',
          'data' => {
                      'comment' => 'This role grants unlimited WebAdmin access.',
                      'members' => [
                                     'REF_rEDbGHyHrY',
                                     'REF_DefaultSuperAdminGroup'
                                   ],
                      'name' => 'SUPERADMIN',
                      'rights' => [],
                      'webadmin_access' => 1
                    },
          'hidden' => 0,
          'lock' => '',
          'nodel' => 'global',
          'ref' => 'REF_SuperadminRole',
          'type' => 'role'
        }

Q:Hum, that's not the default configuration, indeed.Somebody deleted or moved (as in: changed the REF string) of the "admin" user object, it seems.

A: Admin user was deleted since not in use.  I use "wingman" account to connect to the box 

 Q:As which user? admin?

Try:

# cc get_user_by_name admin

But the most important question might be:
What does

# cc get webadmin allowed_networks

tell you?


****:/root # cc get_user_by_name admin
get_user_by_name returned 0

****:/root # cc get webadmin allowed_networks
webadmin->allowed_networks = [
          "REF_DefaultInternalNetwork",

Children

No Data