Community discussions

MikroTik App
 
gtuminauskas
just joined
Topic Author
Posts: 3
Joined: Mon Sep 28, 2020 1:40 pm

system,error,critical login failure for user admin from IP via web

Tue Dec 08, 2020 11:06 am

Hi, there are few problems with the web login

1. I can see these messages everytime page gets refreshed and user "xyz" logins
RouterOS tries to login with "admin" user, but it is deleted - why does it try to login with non-existent username?
P.S. it is not a brute-force
time=10:58:35 topics=system,error,critical message="login failure for user admin from 192.168.1.2 via web" 
time=10:58:36 topics=system,error,critical message="login failure for user admin from 192.168.1.2 via web" 
time=10:58:37 topics=system,info,account message="user xyz logged in from 192.168.1.2 via web" 
2. When refreshig the page, it logs you out and brings back to login page (it does not matter if session lasts 10 seconds, 30mins or 2 hours - always logout on refresh)
 
arfoll
newbie
Posts: 28
Joined: Mon Sep 24, 2012 8:24 pm

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 1:45 pm

I also get this on every login to webfig - am I doing something wrong?
 12:42:05 system,error,critical login failure for user admin from 192.168.88.47 via web
 12:42:06 system,info,account user admin logged in from 192.168.88.47 via web
 
erlinden
Forum Guru
Forum Guru
Posts: 1900
Joined: Wed Jun 12, 2013 1:59 pm
Location: Netherlands

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 1:50 pm

Could it be browser related (like old cookies or something)? Could you try an InPrivate browser instead?
What version of RouterOS are you running?
 
arfoll
newbie
Posts: 28
Joined: Mon Sep 24, 2012 8:24 pm

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 2:03 pm

I'm using:
RouterOS v7.1rc5 on an RB5009
RouterOS v6.49 on a capAC

Accessing webfig using Firefox 92.0.1.

Both display the exact same issue, on first login in private mode or after clearing cookies it's fine, then you hit reload and bam.
 13:02:40 ssh,info publickey accepted for user: admin
 13:02:40 system,info,account user admin logged in from 192.168.88.47 via ssh
 13:02:57 system,error,critical login failure for user admin from 192.168.88.47 via web
 13:02:57 system,error,critical login failure for user admin from 192.168.88.47 via web
 13:02:59 system,info,account user admin logged in from 192.168.88.47 via web
ssh login works perfectly so I can only assume it's a webfig bug.
 
erlinden
Forum Guru
Forum Guru
Posts: 1900
Joined: Wed Jun 12, 2013 1:59 pm
Location: Netherlands

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 2:06 pm

Did you (also) report it in the correct topic:
viewtopic.php?t=179755
 
holvoetn
Forum Guru
Forum Guru
Posts: 5328
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 2:21 pm

Hex with 7.1rc5: I'm not seeing this, only user logged in from web
Cap Ac with 6.49: Not seeing it there either, same log entry as above (login from web)

Must be something local since both show the same behavior for you yet I am not seeing it with the same ROS versions ... already tried a different browser ?
I'm using Edge.
 
arfoll
newbie
Posts: 28
Joined: Mon Sep 24, 2012 8:24 pm

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 4:09 pm

Hex with 7.1rc5: I'm not seeing this, only user logged in from web
Cap Ac with 6.49: Not seeing it there either, same log entry as above (login from web)

Must be something local since both show the same behavior for you yet I am not seeing it with the same ROS versions ... already tried a different browser ?
I'm using Edge.
Same thing on CAP AC using chromium in incognito mode. First login fine, second one triggers it. See below, can't say i've tried on edge I don't have access to a windows PC atm.
[admin@arsenic] > /log print 
...
14:58:08 system,info,account user admin logged in from 192.168.88.47 via ssh 
14:58:33 system,info,account user admin logged in from 192.168.88.47 via web
[admin@arsenic] > 
14:58:46 echo: system,error,critical login failure for user admin from 192.168.88.47 via web 
Did you (also) report it in the correct topic:
viewtopic.php?t=179755
I reported another issue there but since this doesn't seem to be 7.x related I did not and found this thread with very similar issue, I can reproduce same behaviour on the CAP AC running 6.49 as shown above.
 
holvoetn
Forum Guru
Forum Guru
Posts: 5328
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 4:48 pm

I am not saying you're not seeing what you see, I just don't.
Logged in and out a couple of times, I don't get what you see.
15:45:15 system,info,account user xyz logged in from 192.168.2.106 via web
 15:45:58 system,info,account user xyz logged out from 192.168.2.106 via web
 15:46:06 system,info,account user xyz logged in from 192.168.2.106 via web
 15:46:10 system,info,account user xyz logged out from 192.168.2.106 via web
 15:46:14 system,info,account user xyz logged in from 192.168.2.106 via web
 15:46:27 system,info,account user xyz logged in from 192.168.2.106 via telnet
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11383
Joined: Thu Mar 03, 2016 10:23 pm

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 5:19 pm

... then you hit reload and bam.

I never bothered to look into logs, but whatever browser I use, clicking reload button never did anything good on WebFig page. Most of times I was presented with login page ... without any of usual page decoration (Mikrotik logotype, tools buttons, ...).
 
holvoetn
Forum Guru
Forum Guru
Posts: 5328
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 5:24 pm

And we have a winner ...

As soon as I hit reload in webfig using F5 (didn't do it before), the faulty log entry appears.
Definitely some error on that wegpage !

What is ALSO strange ... the error comes from user admin (I notice it since I have REMOVED admin on my setup. Much safer ...)
16:20:49 system,info,account user xyz logged in from 192.168.2.106 via web
16:20:54 system,error,critical login failure for user admin from 192.168.2.106 via web
16:20:56 system,info,account user xyz logged in from 192.168.2.106 via web

I guess it also shows how little the access is being used via browser or it would have been reported all over the place :lol:
 
arfoll
newbie
Posts: 28
Joined: Mon Sep 24, 2012 8:24 pm

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 5:45 pm

And we have a winner ...

As soon as I hit reload in webfig using F5 (didn't do it before), the faulty log entry appears.
Definitely some error on that wegpage !

What is ALSO strange ... the error comes from user admin (I notice it since I have REMOVED admin on my setup. Much safer ...)
16:20:49 system,info,account user xyz logged in from 192.168.2.106 via web
16:20:54 system,error,critical login failure for user admin from 192.168.2.106 via web
16:20:56 system,info,account user xyz logged in from 192.168.2.106 via web

I guess it also shows how little the access is being used via browser or it would have been reported all over the place :lol:
Thanks for confirming i'm not just crazy :D

I'm trying do a little home setup and playing around, I find looking at the logs really helpful to debug my confs so it's annoying me. I'll get rid of admin later, tbh I have only local access so it's not a priority - totally understand that avoiding root/admin is a good way to avoid most the silly spamming :)
 
holvoetn
Forum Guru
Forum Guru
Posts: 5328
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 5:54 pm

Same here.
Still learning a ton about Mikrotik stuff. So I do keep an eye on the logs as well from time to time.

The issue:
reload on webfig page results in authentication error from user admin, EVEN IF that user does not exist !!
Really empty login page is shown with account of last user already prefilled (so it doesn't have to be admin)
Providing password and we're running again.

Next steps:
Do you report the issue to support@mikrotik.com ?
Provide a link to this thread, then they can see what and how.
 
holvoetn
Forum Guru
Forum Guru
Posts: 5328
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 6:02 pm

And to make it complete:
same error/behavior on 6.49 (cAP ac and Cap), same authentication error for user admin (account which also on those devices is not present)
16:59:59 system,info,account user xyz logged in from 10.255.255.3 via web
17:00:07 system,error,critical login failure for user admin from 10.255.255.3 via web
17:00:11 system,info,account user xyz logged in from 10.255.255.3 via web

And 6.48.3 (hAP ac2) ... seems to be an old bug.
 
arfoll
newbie
Posts: 28
Joined: Mon Sep 24, 2012 8:24 pm

Re: system,error,critical login failure for user admin from IP via web

Mon Nov 01, 2021 6:08 pm

I sent them an email and referenced this page.
 
timurrr
just joined
Posts: 1
Joined: Wed May 18, 2022 1:39 pm

Re: system,error,critical login failure for user admin from IP via web

Wed May 18, 2022 1:42 pm

Hi, just a heads up on this issue, having the same and it just drives me crazy. Any feedback from Mikrotik so far?
 
holvoetn
Forum Guru
Forum Guru
Posts: 5328
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: system,error,critical login failure for user admin from IP via web

Wed May 18, 2022 2:04 pm

Not as far as I know but for now, keep your fingers away from F5 to get around the problem :lol:

Who is online

Users browsing this forum: alotofbacardi, Bing [Bot], holvoetn, Sirajs and 54 guests