Fresh install on Debian 13 - zs_logon rejected

geraldh

Hello,
I tried to install grommunio-ce in a new Debian 13 VM - following this thread:

IPv6 is needed (nginx)
gromox-cleaner.service fails to start with grommunio-setup - systemctl restart gromox-cleaner.service helps

But logging in as admin in the admin-web fails - journalctl -f outputs:
gromox-zcore[1300]: user=admin zs_logon rejected: PR_DISPLAY_TYPE_EX is missing for this user

Adding PR_DISPLAY_TYPE_EX as described here makes the log message go away - but I'm still unable to login as admin.
Has anybody suggestions what to try next?

crpb

geraldh IPv6 is needed (nginx)

https://docs.grommunio.com/admin/quickstart.html#minimum-requirements

geraldh gromox-cleaner.service fails to start with grommunio-setup - systemctl restart gromox-cleaner.service helps

most likely as the database isn't fully setup at this point. would need to add debian specific helpers to let it be disabled on installation...

geraldh But logging in as admin in the admin-web fails - journalctl -f outputs:
gromox-zcore[1300]: user=admin zs_logon rejected: PR_DISPLAY_TYPE_EX is missing for this user

hmmm... this doesn't happen here where i just used the "removealldata" option (run grommunio-setup a second time as i didn't wanna setup a completly naked system)

That displaytypeex is very old so that shouldn't be happening i suppose 🙈

geraldh

The password is correct - entering a wrong password results in:

/var/log/php8.4-fpm.log
WARNING: [pool grommunio-web-pool] child 1613 said into stderr: "NOTICE: PHP message: grommunio Web user: admin: authentication failure at MAPI"

journalctl -f
promox-zcore[1297]: rhost= user=admin zs_logon rejected: Incorrect password

crpb

geraldh WARNING: [pool grommunio-web-pool] child 1613 said into stderr: "NOTICE: PHP message: grommunio Web user: admin: authentication failure at MAPI"

uhm, are you trying to log in on "https://youhostname/web" or "https://yourhostname:8443"?

geraldh

arrgh ... yes ... sorry ... 8443 works as documented
But still the login fails - now with "Access denied"
uwsgi[1313]: [WARNING] (grommunio Admin API) Database schema version updated detected - reloading ORM uwsgi[1313]: [WARNING] (security) getUser() failed (ArgumentError): reverse_property 'mlist' on relationship MLists.user references relationship Users.mlist, which does not reference mapper Mapper[MLists(mlists)] uwsgi[1313]: [WARNING] (grommunio Admin API) GET /api/v1/domains?domainType=0&sort=domainname,asc from ip -> 401 '{"error":"Failed to get user information from database","message":"Access denied"}\n'
Will rollback my VM and install from scratch in the evening.

crpb

geraldh uwsgi[1313]: [WARNING] (security) getUser() failed (ArgumentError): reverse_property 'mlist' on relationship MLists.user references relationship Users.mlist, which does not reference mapper Mapper[MLists(mlists)]

this is usually fixed by a systemctl restart grommunio-admin-api
no idea what it mangles there but i see those for a couple months now here and there..

geraldh

yes - a grommunio-admin-api restart fixes the failed admin login - works now - thanks.
Nevertheless will install from scratch once more tomorrow.

geraldh

Fresh install on Debian-13 (and first admin login) went through without any glitches this time - great!
Some small suggestions for grommunio-setup

check for ipv6 at start - setup fails badly, if nginx can not be started
info page at the end of setup - add info about the https 8443 admin port also - if tls was configured

crpb

geraldh info page at the end of setup - add info about the https 8443 admin port also - if tls was configured

already taken care of:
https://github.com/eryx12o45/grommunio-setup/pull/40
https://github.com/grommunio/grommunio-setup/pull/11

geraldh check for ipv6 at start - setup fails badly, if nginx can not be started

do you disable it by default in your installations?

EDIT: the only think which might make sense is something like this i guess..

[ -n "$(ip -6 a show dev lo)" ] || exit 76

geraldh

@crpb - thanks for the enhancements
ipv6 - yes I've mostly disabled it for private IPv4 networks - but I do not refuse to work on systems with ipv6 enabled 😉
another ipv6 test could be:
ping -6 -q -c 1 ::1 &> /dev/null || exit 76