Smoothwall user cannot login, limit reached

[ianniow]

I have this weird problem with one user, who only uses 1 pc. She came in this morning and IE 8 was asking for login for the proxy. I have checked the Auth log and the system says that she has reached her limit.

I can not find out where else in the system that she is logged on. I have had this before with her and logged her on as a test user and it is all fine. Changed a setting in auth and restarted this obviously clears the log because then she can log in again. I would like to clear it without a restart.

Any ideas

[tom_newton]

Does the user appear under services/auth/logged-in users?

 

You should be able to force a logout there.

 

Also you could restart the auth subsystem (services/auth/control) as a last resort - this is faster than restarting virtually anything else, and if you are using NTLM, shouldnt really impact users too heavily.

[cjohnsonuk]

Are you sure its her user limit and not a user limit on smoothwall. We had a similar issue where we bought smoothwall with fewer licenses than we needed (something to do with concurrency) and one busy week it ran out of licences.

[ianniow]

Does the user appear under services/auth/logged-in users?

Shows as logged out

 

You should be able to force a logout there.

 

Also you could restart the auth subsystem (services/auth/control) as a last resort - this is faster than restarting virtually anything else, and if you are using NTLM, shouldnt really impact users too heavily.

 

If I do that how does it affect otherusers

[ianniow]

I have increased user limit to ten and in the authd log it says she has reached that limit

[tom_newton]

An auth restart shouldnt bother other users in an NTLM environment.

 

Sounds like a strange one this - is her PC misbehaving?

Which is the latest auth update you have installed, out of interest?

[tom_newton]

Are you sure its her user limit and not a user limit on smoothwall. We had a similar issue where we bought smoothwall with fewer licenses than we needed (something to do with concurrency) and one busy week it ran out of licences.

 

I think ian is having concurrent (single) user issues rather than licence issues - certainly sounds that way

[ianniow]

An auth restart shouldnt bother other users in an NTLM environment.

Sounds like a strange one this - is her PC misbehaving?

Which is the latest auth update you have installed, out of interest?

 

Thanks I have just come in a bit early this morning and rebooted the whole thing. I checked for updates before reboot and there was only one issued on tues 8th for IDS so installed that.

As far as I can see there is nothing wrong with the PC but this person is not in on Fridays so will give it a going over then.

[tom_newton]

ian, could you pm me over your details, I just want to double check something as there's been a few auth changes recently, want to know which version you run

[bashy]

Have the same issues but with more users just will not validate the logon .. Had to be the head as well. Added local access to bypass this ,.

[DMcCoy]

Having NTLM issues too. That *may* be to do with updating to the new module from the beta (at least it didn't update from the beta to the old one this time )

 

In NTLM auth (TS mode) users were hitting their connection limit and being prompted for username and password (which didn't work).

In NTML auth mode some users just start getting denied messages for all sites, others end up with the error: cache access denied message instead.

 

I have previously traced ntlm issues in the past by matching up ip and incorrect username passed from IE due to broken cached credentials (have to delete a file in the profile), but this does not seem to be the case this time. On the plus side the early beta work perfectly with ntlm, updated to try and get TS mode working as I'm installing some RDS servers at present.

[ianniow]

Thanks Tom PM sent

[john]

Weird one I know but is the time between your Client PC, AD Server that Smoothys talking to and the Smoothy all in sync and singing from the same song sheet?

[tom_newton]

Dave - there is an issue which ian is having with the concurrent logon settings, which you won't have had with the beta (no cl setting) but should be fixed with a patch to the release patch. Make sure you have the very latest... or try turning off concurent limiting!

[tom_newton]

@bashy - just spotted your post - PM me to let me know who you are, and I'll have support get in contact.

[DMcCoy]

Ah yes,

 

Jun 11 09:04:23 s_sys@argo authd: Login failed: user test is already logged in 5 times

 

Seems it's having a little difficulty counting, the beta worked perfectly but as you say, had no concurrent limit.

[DMcCoy]

Just had a call from support after this to tell me about the patch to fix concurrent login issues. Patched the servers now. May take a little while to know if it's worked as there are no students in today due to the festival.

[tom_newton]

That patch has been thoroughly tested and i'm pretty confident it will sort that issue - was a race condition between timeouts and logins with NTLM, which has now been eliminated.

[ianniow]

A bit late in replying but I have applied that latest patch and it seems to work better now.

The problem I have is that during the time when we had the problem. I logged the user on as a testuser. and now that setting has been remembered she is still going through smoothwall as the test user. where is this stored on the pc so I can remove it and get her back to using her own.

[DMcCoy]

What OS? XP has credentials in control panel, user accounts somewhere. Vista/7 has a file in appdata that stores the credentials.

[ianniow]

Thanks for the reply. The os is XP but on a domain user accounts only shows local users.