Can not log in to admin panel anymore

elBasti

Hi, I can not log in to my grommunios admin panel (:8443/admin) anymore. I have already tried to reset the admin users password with "grommunio-admin passwd", tried several reboots and service restarts, but no luck.

From the logs I can see the following:

journalctl -fu grommunio-admin-api

....
Sep 17 20:42:27 gro1.int.kirchner.co systemd[1]: Started grommunio-admin-api.service - grommunio admin api.
Sep 17 20:42:27 gro1.int.kirchner.co uwsgi[27807]: spawned uWSGI worker 1 (pid: 27816, cores: 4)
Sep 17 20:42:48 gro1.int.kirchner.co uwsgi[27816]: [WARNING] (grommunio Admin API) Failed login attempt for user 'admin' from '212.224.127.221': Token generation failed
Sep 17 20:42:48 gro1.int.kirchner.co uwsgi[27816]: [WARNING] (grommunio Admin API) POST /api/v1/login? from 212.224.127.221 -> 401 '{"error":"Token generation failed","message":"Login failed"}\n'

Any idea what could cause this "Token generation failed" error?

Best,
Basti

WalterH

Which operating system and which gromox and gromox-admin-api version?

elBasti

No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 13 (trixie)
Release: 13
Codename: trixie

apt list '?installed ?origin(grommunio)'
esh/stable,unknown,now 0.3.2-2 all [installed,automatic]
grommunio-admin-api-mod-vts/unknown,now 1.21.14.m7efd177-1+81.1 all [installed]
grommunio-admin-api/unknown,now 1.21.14.m7efd177-1+81.1 all [installed]
grommunio-admin-common/unknown,now 51.m8.ab81aa5-1+8.2 amd64 [installed]
grommunio-admin-web/unknown,now 5.0.0.74.c65d5a7-1+215.1 all [installed]
grommunio-common/unknown,now 29.18-1+35.2 amd64 [installed]
grommunio-dav/unknown,now 1.7.5.2310f3a-1 all [installed]
grommunio-dbconf/unknown,now 1.1.2.4bbae9a-1+17.2 amd64 [installed]
grommunio-error-pages/unknown,now 1.0.10.bb2df37-1+24.2 all [installed,automatic]
grommunio-index/unknown,now 1.7.0.g22e0766-1+11.1 amd64 [installed]
grommunio-pkg-bits/unknown,now 23.2 all [installed,automatic]
grommunio-setup/unknown,now 1.8 all [installed]
grommunio-sync/unknown,now 2.5.2.0d70954-1 all [installed]
grommunio-triggers/unknown,now 9-1 all [installed,automatic]
grommunio-web/unknown,now 5.0.20.g3f509ee77-1+676.1 all [installed]
gromox/unknown,now 3.10.184.mba08b18-1+46.1 amd64 [installed]
libesedb1/unknown,now 20240220-1+3.7 amd64 [installed,automatic]
libexmdbpp0/unknown,now 1.11.21.cdfd7bb-1+311.1 amd64 [installed,automatic]
libhx43/unknown,now 5.3-1+1.4 amd64 [installed,automatic]
libolecf1/unknown,now 20240427-1+2.7 amd64 [installed,automatic]
libpff1/unknown,now 20231205-1+2.7 amd64 [installed,automatic]
libsqlite3-0/stable,now 3.46.1-7+deb13u2 amd64 [installed]
libwmime2/unknown,now 1.1.0-1+3.3 amd64 [installed,automatic]
mapi-header-php/unknown,now 2.2.29.da49fe1-1+30.1 amd64 [installed,automatic]
nginx-module-vts/unknown,now 0.2.7-1+1.2 amd64 [installed,automatic]
python3-mattermostdriver/unknown,now 7.3.2-1+19.4 all [installed,automatic]
python3-pyexmdb/unknown,now 1.11.21.cdfd7bb-1+311.1 amd64 [installed,automatic]
sqlite3/stable,now 3.46.1-7+deb13u2 amd64 [installed]
system-user-grommunio/unknown,now 9-1 all [installed,automatic]
system-user-gromox/unknown,now 9-1 all [installed,automatic]

elBasti

After doing some reverse engineering within the code I might have found the issue, but still no clue how this happened and how to fix it.

The error is raised within the mkJWT function in /usr/share/grommunio-admin-api/api/security.py.
Some debugging took me over to /usr/lib/python3/dist-packages/jwt/algorithms.py which raised: "jwt.exceptions.InvalidKeyError: Could not parse the provided public key."

From the config I found the keys are stored here, but the files are empty:

ls -la /var/lib/grommunio-admin-api
drwxr-x---  2 grommunio grommunio    2 Aug 22 19:10 .
drwxr-xr-x 45 root      root      4096 Sep 17 17:50 ..
-rw-------  1 grommunio www-data     0 Sep 14 11:17 auth-private.pem
-rw-r--r--  1 grommunio www-data     0 Sep 14 11:17 auth-public.pem

mwilliams

elBasti

try to remove the files under /var/lib/grommunio-admin-api and restart. admin-api regenerates automatically.

Steakie

Don't know the cause/origin of this bug since it is basically unreproducable, but you can create your own keypair with openssl and/or ssh-keygen

elBasti

Sorry for the late reply, managed to fix it by regenerating the key pair with openssl. Deleting the files and restarting the service did not help.