Bareos error: Sorry, can not authenticate. Wrong username and/or password

[Mik Bakker]

I wanted to give Bareos (Open Source Data Protection) a go to see how it works and performs. However I cannot even get past the basic installation and get it working...

I followed the following installation tutorial (several times now): https://www.svennd.be/installing-bareos-on-centos-7/

But I am getting every time the following error: Sorry, can not authenticate. Wrong username and/or password.

I don't understand what I am doing wrong. I even tried using the previous version of Bareos 16.2, but that didn't make a difference and I experience the same issue. I am 200% sure the password and username are correct.

I also consulted the logs:
17-Mar 13:00 bareos-dir JobId 0: Fatal error: Authorization key rejected by Console USERNAME.
Please see http://doc.bareos.org/master/html/bareos-manual-main-reference.html#AuthorizationErrors for help.
17-Mar 13:00 bareos-dir: ERROR in authenticate.c:283 Unable to authenticate console "USERNAME"


I checked that page (also several times) and even made sure the (user)names/passwords were correct. But still I get the message "Sorry, can not authenticate. Wrong username and/or password." when I try to login on "bareos-webui".

Probably I am doing something wrong, but I cannot disover what.

I have the following files available. Maybe I need to make certain changes to those as well?

/etc/bareos/bareos-dir.d/director/bareos-dir.conf
/etc/bareos/bareos-fd.d/director/bareos-dir.conf
/etc/bareos/bareos-sd.d/director/bareos-dir.conf
/etc/bareos/bconsole.conf
/etc/bareos/bareos-sd.d/storage/bareos-sd.conf
/etc/bareos/bareos-dir.d/client/bareos-fd.conf
/etc/bareos/bareos-dir.d/job/backup-bareos-fd.conf

When I compared some files, they have different passwords in them?

For example: /etc/bareos/bareos-fd.d/director/bareos-dir.conf
Director {
Name = bareos-dir
Password = "J36zN1mQVF5lLA/FP0kASo+X9wTo8D988nsVqZjx"
Description = "Allow the configured Director to access this file daemon."
}


And /etc/bareos/bareos-sd.d/director/bareos-dir.conf

Director {
Name = bareos-dir
Password = "PAU/ov3RvnFp0I59brd4d8u9m8ejRpkVE7P/4Qz3"
Description = "Director, who is permitted to contact this storage daemon."
}


And (one more example): /etc/bareos/bconsole.conf

# Bareos User Agent (or Console) Configuration File
Director {
Name = bareos-dir
address = localhost
Password = "Fs5JnyO1ypBhcR0D9CNkx3gynPMa+jmp7sj9Ghst"
Description = "Bareos Console credentials for local Director"
}


They all have different passwords here? As I understand it, from the online docs, they should all be the same, right?

Maybe that's the issue? Hopefully someone can explain things a bit better or advice me what to do in order to get this working... Maybe it's something simple that I may overlooked?

FYI: I whitelisted all IP's and ports I use on this server.

I re-read the documents once again and it says: "The default configuration files are automatically defined for correct authorization with random passwords. If you add to or modify these files, you will need to take care to keep them consistent."

So if I didn't change a thing, it should have worked in the first place, right? So I think something else is wrong here?

Hopefully someone can point me in the right direction and share their insights on what I am doing wrong here, or what I should do, or what I am completely missing here... Thank you kindly in advance.

Regards,
Mik

[Mik Bakker]

By the way, I did create the user in bconsole, as mentioned in the tutorial.

[Jörg Steffens]

On 20.03.2018 at 08:55 wrote Mik Bakker:
> I wanted to give Bareos (Open Source Data Protection) a go to see how
> it works and performs. However I cannot even get past the basic
> installation and get it working...
>
> I followed the following installation tutorial (several times now):
> https://www.svennd.be/installing-bareos-on-centos-7/
>
> But I am getting every time the following error: Sorry, can not
> authenticate. Wrong username and/or password.

from the bconsole or the webui?

no, these are intended to be different.

The password in /etc/bareos/bconsole.conf have to match the password in
/etc/bareos/bareos-dir.d/director/bareos-dir.conf.
Unfortunately, this file is not given.

> Maybe that's the issue? Hopefully someone can explain things a bit
> better or advice me what to do in order to get this working... Maybe
> it's something simple that I may overlooked?
>
> FYI: I whitelisted all IP's and ports I use on this server.
>
> I re-read the documents once again and it says: "The default
> configuration files are automatically defined for correct authorization
> with random passwords. If you add to or modify these files, you will
> need to take care to keep them consistent."
>
> So if I didn't change a thing, it should have worked in the first
> place, right?

Yes. At least the 3 daemon on the same server and the bconsole. webui is
another matter.

You also mention that you have created a user via bconsole. Can you give
more details on that?

[...]

--
Jörg Steffens joerg.s...@bareos.com
Bareos GmbH & Co. KG Phone: +49 221 630693-91
http://www.bareos.com Fax: +49 221 630693-10

Sitz der Gesellschaft: Köln | Amtsgericht Köln: HRA 29646
Komplementär: Bareos Verwaltungs-GmbH
Geschäftsführer:
S. Dühr, M. Außendorf, Jörg Steffens, P. Storz

[Mik Bakker]

Hi Jörg,

Thanks for taking the time to help me.

I just redid the installation, as mentioned in the given tutorial. So I have a clean install.

I checked both files and they to match, but here is the output:

/etc/bareos/bconsole.conf:

# Bareos User Agent (or Console) Configuration File

#

Director {
Name = bareos-dir
address = localhost

Password = "Zv50xay/lfq8dxVpxWcmOAqzwNrv0j0zJGyCcV39"

Description = "Bareos Console credentials for local Director"
}

And /etc/bareos/bareos-dir.d/director/bareos-dir.conf:

Director { # define myself
Name = bareos-dir
QueryFile = "/usr/lib/bareos/scripts/query.sql"
Maximum Concurrent Jobs = 10
Password = "Zv50xay/lfq8dxVpxWcmOAqzwNrv0j0zJGyCcV39" # Console password
Messages = Daemon
Auditing = yes

So the passwords both match. So that's good I guess.

I created an user with bconsole. This was mentioned in the tutorial.

bconsole
configure add console name=DirUserName password=RndPass001 profile=webui-admin

After that I got a message that it created a resource config file:

Created resource config file "/etc/bareos/bareos-dir.d/console/DirUserName.conf":
Console {
Name = DirUserName
Password = RndPass001
Profile = webui-admin
}

Then I logged out of bconsole and restarted all services to make sure.


When I try to login on bareos-webui, with the created credentials, I get the "Sorry, can not authenticate. Wrong username and/or password." as described in my first post.

Probably I am making a beginners mistake somewhere, but what I do find weird, is that in the mentioned tutorial the created user can simply login without any other actions. So I am doing something wrong, or the tutorial is incorrect or missing some step?

Regards,
Mik


Op dinsdag 20 maart 2018 10:27:15 UTC+1 schreef Jörg Steffens:

> Jörg Steffens joerg.steffens @bareos.com

[Mik Bakker]

Well I retried the complete tutorial several times and this time on different servers. But all with the same result, as mentioned in the first post:

Sorry, can not authenticate. Wrong username and/or password.

20-Mar 18:50 bareos-dir JobId 0: Fatal error: Authorization key rejected by Console BackupUsername.

Please see http://doc.bareos.org/master/html/bareos-manual-main-reference.html#AuthorizationErrors for help.

20-Mar 18:50 bareos-dir: ERROR in authenticate.c:283 Unable to authenticate console "BackupUsername" at client:85.190.190.190:9101.

Username and IP are fictional obviously...

No clue what's wrong here, or what I am doing wrong. Seems hopeless...

[Mik Bakker]

Also the screenshot in the documents do not provide any real help in regards to these so-called "Authorization Issues".

[root@bareos-gui console]# locate bareos-dir.conf
/etc/bareos/bareos-dir.d/director/bareos-dir.conf
/etc/bareos/bareos-fd.d/director/bareos-dir.conf
/etc/bareos/bareos-sd.d/director/bareos-dir.conf

[root@bareos-gui console]# locate bconsole.conf
/etc/bareos/bconsole.conf

[root@bareos-gui console]# locate bareos-sd.conf
/etc/bareos/bareos-sd.d/storage/bareos-sd.conf

[root@bareos-gui console]# locate bareos-fd.conf
/etc/bareos/bareos-dir.d/client/bareos-fd.conf
/etc/bareos/bareos-dir.d/job/backup-bareos-fd.conf

Maybe everyone is has an IQ of 140 and mine is lower, because I really don't understand what I am doing wrong here. Also some advice would be very helpful and productive.

[Jörg Steffens]

On 20.03.2018 at 10:41 wrote Mik Bakker:
> Hi Jörg,
>
> Thanks for taking the time to help me.
>
> I just redid the installation, as mentioned in the given tutorial. So I have a clean install.
>
> I checked both files and they to match, but here is the output:
>
> /etc/bareos/bconsole.conf:
>
> # Bareos User Agent (or Console) Configuration File
> #
>
> Director {
> Name = bareos-dir
> address = localhost
> Password = "Zv50xay/lfq8dxVpxWcmOAqzwNrv0j0zJGyCcV39"
> Description = "Bareos Console credentials for local Director"
> }
>
>
> And /etc/bareos/bareos-dir.d/director/bareos-dir.conf:
>
> Director { # define myself
> Name = bareos-dir
> QueryFile = "/usr/lib/bareos/scripts/query.sql"
> Maximum Concurrent Jobs = 10
> Password = "Zv50xay/lfq8dxVpxWcmOAqzwNrv0j0zJGyCcV39" # Console password
> Messages = Daemon
> Auditing = yes
>
> So the passwords both match. So that's good I guess.

yes.

> I created an user with bconsole. This was mentioned in the tutorial.
>
> bconsole
> configure add console name=DirUserName password=RndPass001 profile=webui-admin
>
> After that I got a message that it created a resource config file:
>
> Created resource config file "/etc/bareos/bareos-dir.d/console/DirUserName.conf":
> Console {
> Name = DirUserName
> Password = RndPass001
> Profile = webui-admin
> }
>
> Then I logged out of bconsole and restarted all services to make sure.

That should not be required, but it also does not hurt.

> When I try to login on bareos-webui, with the created credentials, I get the "Sorry, can not authenticate. Wrong username and/or password." as described in my first post.



> Probably I am making a beginners mistake somewhere, but what I do find weird, is that in the mentioned tutorial the created user can simply login without any other actions.

This is correct.

> So I am doing something wrong, or the tutorial is incorrect or missing some step?

This seams to be correct, as long as the bareos-webui is installed on
the same system as the bareos-director, which seams to be the case.

You can verify settings, by running following commands in the bconsole:
show console
show profile

but normally there should be no need for it.

Additional you can try the same connection as used by the bareos-webui
by installing python-bareos.

Add a console at bconsole:

configure add console name=admin password=secret profile=webui-admin

Call bconsole.py from python.bareos with following arguments:

bconsole.py --debug --name=admin --password=secret 127.0.0.1

and check if it connects.



regards,
Jörg

--
Jörg Steffens joerg.s...@bareos.com

[Mik Bakker]

Yeah, that's why I understand I am experiencing these difficulties. At first I thought it might be the OpenVZ container, so I created a bare-metal server instead with CentOS 7.x.

But still the same issue.

Anyways, I installed "yum install python-bareos"

I followed your steps, but tried it first with my own created credentials. For some reason it didn't work (maybe to many difficult characters?).

So I followed your tutorial (though I changed the username and password a bit):

This is the result:

[root@bareos-gui director]# bconsole.py --debug --name=admin555 --password=secret999 127.0.0.1
DEBUG bconsole.<module>: address: 127.0.0.1
DEBUG bconsole.<module>: port: 9101
DEBUG bconsole.<module>: dirname: ""
DEBUG bconsole.<module>: name: admin555
DEBUG bconsole.<module>: options: {'port': 9101, 'name': 'admin555', 'address': '127.0.0.1'}
DEBUG lowlevel.__init__: init
DEBUG lowlevel.__connect: connected to 127.0.0.1:9101
DEBUG lowlevel.send: Hello admin555 calling

DEBUG lowlevel.__get_header: remaining header len: 4
DEBUG lowlevel.recv_submsg: submsg len: 55
DEBUG lowlevel._cram_md5_respond: (recv): auth cram-md5 <1478914868.1521581178@bareos-dir> ssl=0

DEBUG lowlevel.send: T+s8r5+MB+E8U+chP+IVXA
DEBUG lowlevel.__get_header: remaining header len: 4
DEBUG lowlevel.recv_submsg: submsg len: 13
DEBUG lowlevel.send: auth cram-md5 <7477529783.1521581178@admin555> ssl=0

DEBUG lowlevel.__get_header: remaining header len: 4
DEBUG lowlevel.recv_submsg: submsg len: 23
DEBUG lowlevel._cram_md5_challenge: received: gGcvuV/mm6cJ395X3z+g5A
DEBUG lowlevel._cram_md5_challenge: string_to_base64, compatible: gGcvuVHmmacJ3N5X3zKg5A
DEBUG lowlevel._cram_md5_challenge: string_to_base64, not compatible: gGcvuV/mm6cJ395X3z+g5A
DEBUG lowlevel.send: 1000 OK auth

DEBUG lowlevel.__get_header: remaining header len: 4
DEBUG lowlevel.recv_submsg: submsg len: 50
DEBUG lowlevel.recv_msg: msg "1000 OK: bareos-dir Version: 17.2.4 (21 Sep 2017)" matches regex "^1000 OK.*$"
DEBUG lowlevel.send: autodisplay off
DEBUG lowlevel.__get_header: remaining header len: 4
DEBUG lowlevel.recv_submsg: submsg len: 19
DEBUG lowlevel.__get_header: remaining header len: 4
DEBUG lowlevel.__set_status: End of data stream, new data may follow (-1)
DEBUG bconsole.<module>: authentication successful

Result: authentication successful

So since this is succesful? What's wrong? :(

[Mik Bakker]

Okay small follow-up. On the OpenVZ container I redid the complete install (again). And ran the python script.

Result:
<snip>

DEBUG bconsole.<module>: authentication successful

And now I can login...?!

Now I am wondering can it be the used username? Username was something like this: "WELBackup"

And the password started with an exclamation mark (!) and ended with a hashtag (#) symbol.

Maybe that's causing the issues? Because the setup was done like previously, so no change in that. Maybe the password/username is to difficult for Bareos. LOL.

Regards,
Mik

[Jörg Steffens]

So, you can login with your username + password using bconsole.py? But
it still fails with bareos-webui?

I've never heard about problems with specific username + password
combinations with the webui, but to make sure, you may create simple
(all lowercase, no special characters) credentials and test it with them.

[Bruno Friedmann]

On mardi, 20 mars 2018 10.41:16 h CET Mik Bakker wrote:
> /etc/bareos/bareos-dir.d/console/DirUserName.conf

Did you check the rights and owner of this file
Just to be sure, that the dir daemon will be able to read it.

Also (even if that sound stupid) edit the file and put double quote around
values
Password = "RndPass001"

--

Bruno Friedmann
Ioda-Net Sàrl www.ioda-net.ch
Bareos Partner, openSUSE Member, fsfe fellowship
GPG KEY : D5C9B751C4653227
irc: tigerfoot

[Mik Bakker]

Apparently it didn't like the password or username. I used something else, more "simple" (as mentioned below) and now it works.

I didn't do anything else at all. Just followed the tutorial in my first post.

Op woensdag 21 maart 2018 07:49:07 UTC+1 schreef Mik Bakker:

[Jörg Steffens]

On 22.03.2018 at 08:37 wrote Mik Bakker:
> Apparently it didn't like the password or username. I used something else, more "simple" (as mentioned below) and now it works.
>
> I didn't do anything else at all. Just followed the tutorial in my first post.

Okay, good to know. Can you provide the non working credentials? Then I
(or you) can create a proper bug report at https://bugs.bareos.org/

[Bruno Friedmann]

On jeudi, 22 mars 2018 08.54:24 h CET Jörg Steffens wrote:
> On 22.03.2018 at 08:37 wrote Mik Bakker:
> > Apparently it didn't like the password or username. I used something else,
> > more "simple" (as mentioned below) and now it works.
> >
> > I didn't do anything else at all. Just followed the tutorial in my first
> > post.
> Okay, good to know. Can you provide the non working credentials? Then I
> (or you) can create a proper bug report at https://bugs.bareos.org/

if it use a # I suspect that it parsed as a comment
this is documented

but it should work if taken between "#"