ejabberd authentication failed randomly

[processone]

ejabberd authentication failed randomly

[pcdinh]

ejabberd authentication works stably for a week then it fails randomly. If I restart it, the authentication works again

[MaximeCheramy]

I have the same issue using ejabberd 2.1.10 and PAM. I'm using pam in order to allow a user to have 2 different passwords, however, after a few days (usually 2-3), ejabberd only accept one password.
I've checked pam using pamtester and PAM still accept both passwords. Ejabberd works again properly after a restart.

Any idea?

[zinid]

@MaximeCheramy what if you kill epam program only? Does it help? Or full ejabberd restart is required?

[MaximeCheramy]

@zinid I can't ssh the server right now, I'll try later or ask to someone to do it for me. Anyway, I wanted to add that ,apparently, users who do their first auth can use any password (between the 2 accepted by the PAM module).

[zinid]

Hum, I didn't get the last sentence, could you describe in details how you manage to provide several password for users? Is it totally handled by the corresponding PAM module?

[MaximeCheramy]

Yes, it is totally handled by the PAM module (the conf is : internal, pam). Users can either use, for the password, their LDAP password or a secret token delivered by the website when they are logged in. The PAM module is working perfectly well and it was working with ejabberd until we did an upgrade (of ejabberd and the rest of the system).

Since the upgrade, users can use either the ldap password or the token as expected until it stops working after a few days for no apparent reason. But (apparently) it still works for the users who did not authenticate yet.

[zinid]

When it stops working, it means neither internal nor pam auth is working, right?

[MaximeCheramy]

Nope, it means that only one password is accepted. For example, user toto (an LDAP user) can use as a password "mypass" and "mytoken" but after a while, when I say it stops working, only one of the password is accepted ("mypass" for my account). toto is not an internal account.

[MaximeCheramy]

I now have an access to the server. killing epam solves the problem for now.

[zinid]

You can try to strace(1) the epam process to see what happens.
Anyway, this is really odd stuff :(

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.