For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JoshBarrow's avatar
JoshBarrow
Icon for Cirrus rankCirrus
Feb 23, 2021

LTM GUI Login

Hey,   So we have an issue where it sometimes takes us multiple times to log into the GUI interface of our LTMs. even if our username and password is correct, it will still hang or say "login fai...
application delivery
LTM
Mayur_Sutare's avatar
Mayur_Sutare
Icon for MVP rankMVP
Feb 24, 2021

Hello,

 

Did you checked the audit logs for failed attempts? Logs are available at /var/log/audit

JoshBarrow's avatar
JoshBarrow
Icon for Cirrus rankCirrus
Feb 24, 2021

I did. it said something along the lines of info httpd(pam_audit)[8484]: 01234567:8: AUDIT - user username - RAW: httpd(pam_audit): User=j.smith tty=(unknown) host=10.10.10.10 failed to login after 1 attempts (start="Mon Jan 1 12:00:00 2019" end="Mon Jan 1 12:00:02 2019").

 

I saw that this article explained that this was a bug inside the Big-IP system. https://support.f5.com/csp/article/K54339562 but we're on version 14.x.x.x which it was supposed to be patched in. Is that still the case?

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Feb 27, 2021

    are you on 14.0.1.6 or higher within 14? then it should be fixed indeed

     

    a packet capture on the LDAP traffic might be useful, is it indeed a timeout issue or something else?

  • JoshBarrow's avatar
    JoshBarrow
    Icon for Cirrus rankCirrus
    Mar 04, 2021

    I'm thinking it is a timeout issue with our F5 having issues talking to our DCs. I'm thinking it might be hard because we also use LDAP as Authentication for some of our APMs. I'll definitely try that out.

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Mar 04, 2021

    ah yeah that complicates things some. still if you capture full traffic you can search on the admin username. just be sure they dont also login to APM at the same time.