After fresh install cant login on panel

johncp · February 3, 2023, 11:01am

Hello guys,

Is just a week now that i have tried several times to setup server with Hestiacp without luck.

And here i think you are my last help before quite all tries.

I make fresh install of Hestia on new vps server in oracle but i cant login.

here is my logs

auth.log
2023-02-03 10:16:51 admin 271.72.63.621 failed to login
2023-02-03 10:16:51 admin 271.72.63.621 failed to login
2023-02-03 10:17:21 admin 271.72.63.621 failed to login
2023-02-03 10:17:21 admin 271.72.63.621 failed to login
2023-02-03 10:27:56 admin 271.72.63.621 failed to login
2023-02-03 10:27:56 admin 271.72.63.621 failed to login
2023-02-03 10:31:05 admin 271.72.63.621 failed to login
2023-02-03 10:31:05 admin 271.72.63.621 failed to login

any help?

eris · February 3, 2023, 3:44pm

v-change-user-password admin ‘newpassword’

Also check /var/log/hestia/nginx-error.log

johncp · February 6, 2023, 1:54pm

I attempted to reset my password, but was unsuccessful. I also tried logging in from various browsers and computers, with no success. At times, it doesn’t even prompt me for a password, simply repeatedly redirecting me and asking for my username.

In nginx-error.log i got this error multiple times in it: (i masked the ip for security resons)

2023/02/06 13:44:44 [error] 4253#0: *89 FastCGI sent in stderr: “PHP message: PHP Warning: Undefined array key “user” in /usr/local/hestia/web/inc/main.php on line 71PHP message: PHP Deprecated: escapeshellarg(): Passing null to parameter #1 ($arg) of type string is deprecated in /usr/local/hestia/web/inc/main.php on line 71” while reading response header from upstream, client: 65.81.712.411, server: _, request: “POST /login/ HTTP/1.1”, upstream: “fastcgi://unix:/var/run/hestia-php.sock:”, host: “132.16.10.19:2083”, referrer: “https://132.16.10.19:2083/login/”

Raphael · February 6, 2023, 3:25pm

maybe disk space full?

jlguerrero · February 6, 2023, 4:04pm

The database is down because the disknis full

eris · February 6, 2023, 4:10pm

New install wonder how large the disk is then…

johncp · February 6, 2023, 6:29pm

Thank you for your response. I don’t believe the issue is with the disk space as it has 200 GB and the system is a fresh install without any website on it. I haven’t been able to find a way to log in to the admin panel yet. Here is my disk space information.

Filesystem Size Used Avail Use% Mounted on
tmpfs 2.4G 1.5M 2.4G 1% /run
/dev/sda1 194G 3.1G 191G 2% /
tmpfs 12G 0 12G 0% /dev/shm
tmpfs 5.0M 0 5.0M 0% /run/lock
/dev/sda15 98M 5.1M 93M 6% /boot/efi
tmpfs 2.4G 4.0K 2.4G 1% /run/user/1001

eris · February 6, 2023, 6:48pm

Do you mind if I take a look into your server?

DM me your ssh details. Because I have never seen it like this before…

jlguerrero · February 6, 2023, 10:45pm

Is MySQL up and running?

The command is v-list-sys-services or something similar.

johncp · February 7, 2023, 6:58am

Hello jlguerrero
as i check the Mysql is ok

NAME STATE CPU MEM UPTIME

apache2 running 0 457 1041
php8.0-fpm running 0 9 1042
nginx running 0 17 1042
bind9 running 0 59 1042
exim4 running 0 13 1042
dovecot running 0 0 1042
clamav-daemon running 0 1318 1042
spamassassin running 0 280 1042
mariadb running 0 661 1042
vsftpd running 0 1 1042
cron running 0 0 1042
ssh running 0 5 1041
iptables running 0 0 0
fail2ban running 0 415 1042

eris · February 7, 2023, 9:23am

Hestia doesn’t use a database for autentication.

As I don’t have issues logging into his server I think it is an issue at Client side that it doesn’t accept .

johncp · February 7, 2023, 12:11pm

I have attempted to log in from Chrome, Firefox, and Edge on two separate computers. I also tried accessing it from Safari on my iPad, but it logs me out after a short period of time.

johncp · February 7, 2023, 3:10pm

I believe I am making progress in finding the issue. I discovered that my network operates on two IPs, and the network dynamically balances between them. As a result, my computer changes its public IP, which sometimes causes it to prompt me to log in again or not log me in at all.

Is there any option about that in Hestia Panel?

Raphael · February 7, 2023, 3:17pm

yes, the public ip will be used to generate a salt - if you have it changing every minute, you’ll get logged out everytime:

github.com

hestiacp/hestiacp/blob/main/web/login/index.php#L115-L132


      
          		$v_user = quoteshellarg($user);
          		$ip = $_SERVER["REMOTE_ADDR"];
          		$user_agent = $_SERVER["HTTP_USER_AGENT"];
          		if (isset($_SERVER["HTTP_CF_CONNECTING_IP"])) {
          			if (!empty($_SERVER["HTTP_CF_CONNECTING_IP"])) {
          				$ip = $_SERVER["HTTP_CF_CONNECTING_IP"];
          			}
          		}
          		$v_ip = quoteshellarg($ip);
          		$v_user_agent = quoteshellarg($user_agent);
          
          
		// Get user's salt
          		$output = "";
          		exec(
          			HESTIA_CMD . "v-get-user-salt " . $v_user . " " . $v_ip . " json",
          			$output,
          			$return_var,
          		);

eris · February 7, 2023, 3:37pm

It is used here:

github.com

hestiacp/hestiacp/blob/beb05ac7d7bae760522c49c1620f89731d1f70dc/web/inc/main.php#L39-L66


      
          $user_combined_ip = "";
          if (isset($_SERVER["REMOTE_ADDR"])) {
          	$user_combined_ip = $_SERVER["REMOTE_ADDR"];
          }
          if (isset($_SERVER["HTTP_CLIENT_IP"])) {
          	$user_combined_ip .= "|" . $_SERVER["HTTP_CLIENT_IP"];
          }
          if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
          	$user_combined_ip .= "|" . $_SERVER["HTTP_X_FORWARDED_FOR"];
          }
          if (isset($_SERVER["HTTP_FORWARDED_FOR"])) {
          	$user_combined_ip .= "|" . $_SERVER["HTTP_FORWARDED_FOR"];
          }
          if (isset($_SERVER["HTTP_X_FORWARDED"])) {
          	$user_combined_ip .= "|" . $_SERVER["HTTP_X_FORWARDED"];
          }
          if (isset($_SERVER["HTTP_FORWARDED"])) {
          	$user_combined_ip .= "|" . $_SERVER["HTTP_FORWARDED"];
          }
          if (isset($_SERVER["HTTP_CF_CONNECTING_IP"])) {

This file has been truncated. show original

And

github.com

hestiacp/hestiacp/blob/beb05ac7d7bae760522c49c1620f89731d1f70dc/web/inc/main.php#L68-L76


      
          // Checking user to use session from the same IP he has been logged in
          if ($_SESSION["user_combined_ip"] != $user_combined_ip && isset($_SESSION["user"])) {
          	$v_user = quoteshellarg($_SESSION["user"]);
          	$v_session_id = quoteshellarg($_SESSION["token"]);
          	exec(HESTIA_CMD . "v-log-user-logout " . $v_user . " " . $v_session_id, $output, $return_var);
          	destroy_sessions();
          	header("Location: /login/");
          	exit();
          }

johncp · February 8, 2023, 12:44pm

Confirm the problem was the IP change.

Thank you guys for your help.