[rabbitmq-discuss] Connection attempt from disallowed node question

[Derek Greer]

I've installed RabbitMQ successfully on several Windows servers and documented the process for the admins at our company.  Upon following my instructions for adding a new user, they received an error along the lines of:

 Error: unable to connect to node rabbit@[machinename]: nodedown.  

The logs also have the following:

 =ERROR REPORT==== 13-Mar-2012::15:00:15 ===

110 ** Connection attempt from disallowed node rabbitmqctl32476@[machine name] **

Everything I've read about this says this is due to the erlang cookie of the user executing the rabbitmqctl.bat command not matching the global erlang cookie in C:\Windows, so I've had the admin check these values and he claims they are the exact same.  The RabbitMQ service is running as the default system account which doesn't have a home directory, so I assume the service runs the process with the cookie from C:\Windows.

Can anyone provide some guidance for where to go next?

Thanks,

Derek

[Emile Joubert]

Hi Derek,

On 13/03/12 22:22, Derek Greer wrote:
> =ERROR REPORT==== 13-Mar-2012::15:00:15 ===
> 110 ** Connection attempt from disallowed node rabbitmqctl32476@[machine
> name] **
>
> Everything I've read about this says this is due to the erlang cookie of
> the user executing the rabbitmqctl.bat command not matching the global
> erlang cookie in C:\Windows, so I've had the admin check these values
> and he claims they are the exact same. The RabbitMQ service is running
> as the default system account which doesn't have a home directory, so I
> assume the service runs the process with the cookie from C:\Windows.

Yes, this error is due to mismatched cookie files between the running
service and the user running the rabbitmqctl.bat command.

If the service runs in an environment with a HOMEDRIVE and HOMEPATH
variable then the GetWindowsDirectory Windows API function is used to
locate the Erlang cookie file. The cookie file in the Windows directory
must match the cookie file in the home directory of the user running the
rabbitmqctl command, as explained here:

http://www.rabbitmq.com/install-windows-manual.html#find-rabbitmq-on-windows

You can obtain the hash of the cookie by turning on console logging (set
RABBITMQ_CONSOLE_LOG to new or reuse) and checking the line starting
with "cookie hash :".

There are some Erlang configuration parameters that are able override
the cookie value. Ensure that the startup scripts and rabbitmq.config
files have not been customised in this way.

If the Erlang VM does not find a cookie file then one will be created
with random contents. Make sure that the contents of the cookie files
were not auto-filled when starting up.

-Emile
_______________________________________________
rabbitmq-discuss mailing list
rabbitmq...@lists.rabbitmq.com
https://lists.rabbitmq.com/cgi-bin/mailman/listinfo/rabbitmq-discuss

[Emile Joubert]

Hi Derek,

On 14/03/12 11:32, Emile Joubert wrote:
> You can obtain the hash of the cookie by turning on console logging (set
> RABBITMQ_CONSOLE_LOG to new or reuse) and checking the line starting
> with "cookie hash :".

On 14/03/12 11:51, Derek Greer wrote:
> The cookie files are the same between the user and the Windows
> directory cookie. I'm assuming this means the service process somehow
> couldn't locate the windows cookie file? How do I see the logs for
> the installed service?

See the instructions at these links

http://www.rabbitmq.com/install-windows-manual.html
http://www.rabbitmq.com/man/rabbitmq-service.man.html

for how to set RABBITMQ_CONSOLE_LOG and obtain the startup banner. This
will provide the cookie hash of the running broker. You can compare this
value with the error messages from rabbitmqctl.bat to confirm whether
the cookie values are indeed the same.

[Derek Greer]

Thanks for the help.  I believe I have the problem resolved now.  What seems to be the issue is that our network logins don't point to the local user home directory.  This does raise another question, however.  On my local machine, opening up the cmd.exe shell drops me in C:\Users\[MyUserId]\ folder.  Within this folder, I have an .erlang.cookie file that matches the C:\Windows\.erlang.cookie file.  The values for my HOMEDIR and HOMEPATH variables are H: and \ respectively, and I found that there was also a .erlang.cookie file in that folder as well that didn't match.  At what point did each of these files get created?  I'm assuming that the Erlang installer created a cookie in one of the folders while running an erlang process for the first time user my user created the other.  Could this be an issue with the installer perhaps?

Derek

On Wed, Mar 14, 2012 at 6:58 AM, Emile Joubert <em...@rabbitmq.com> wrote:

Hi Derek,

On 14/03/12 11:32, Emile Joubert wrote:
> You can obtain the hash of the cookie by turning on console logging (set
> RABBITMQ_CONSOLE_LOG to new or reuse) and checking the line starting
> with "cookie hash    :".

On 14/03/12 11:51, Derek Greer wrote:
> The cookie files are the same between the user and the Windows
> directory cookie. I'm assuming this means the service process somehow
> couldn't locate the windows cookie file?  How do I see the logs for
> the installed service?

See the instructions at these links

http://www.rabbitmq.com/install-windows-manual.html
http://www.rabbitmq.com/man/rabbitmq-service.man.html

for how to set RABBITMQ_CONSOLE_LOG and obtain the startup banner. This
will provide the cookie hash of the running broker. You can compare this
value with the error messages from rabbitmqctl.bat to confirm whether
the cookie values are indeed the same.


-Emile

--

___________________________________________

Derek Greer

dbg...@gmail.com     | @derekgreer

freshbrewedcode.com | lostechies.com | aspiringcraftsman.com

___________________________________________

[Rader]

Hi Derek,

Thanks for sharing your discovery. I get the same problem with you. The cookie in user_home is not used by rabbitmqctl.bat, but the cookie under "H:" drive is used. I don't know why.