topic Re: SSMC generating authentication failures in HPE 3PAR StoreServ Storage

SSMC generating authentication failures

csbuxton — Wed, 01 Mar 2017 15:28:05 GMT

We are seeing authentication failures on all of our arrays (30+). I ran the CLI commands to find the source and it is always our SSMC server. This is annoying because the alerts are a "degraded" level alert so we constantly have our arrays in a degraded state and we have missed other alerts because of this. In our configuration I have created a local user on the array with the browse role. This user is then what I use to connect the array to SSMC. Has anybody else seen this type of issue and how did you solve it?

Re: SSMC generating authentication failures

Sheldon Smith — Thu, 02 Mar 2017 17:23:18 GMT

If you connect to a StoreServ with a set of credentials (username and password) and then change those credentials, how do you expect SSMC to gather information from the StoreServ?
Looking through the SSMC Administrator's Guide, setting up a local user with only browse role, as you did, is suggested.

Re: SSMC generating authentication failures

csbuxton — Thu, 02 Mar 2017 18:03:01 GMT

I don't change those credentials, let me be more clear:

We create a user on the array named SSMC with the browse role. In the administrator console of SSMC (3.0 - btw), we add the array and use the SSMC user to establish the initial connection. Our arrays are configured for ldap authenticaion, so when we log into SSMC using domain credentials, that account is then used on the array to determine my rights to change things.

Re: SSMC generating authentication failures

Sheldon Smith — Fri, 03 Mar 2017 17:09:31 GMT

That all sounds correct. Not sure why there would be authentication failures. Suggest you open a ticket with HPE StoreServ Support.

Re: SSMC generating authentication failures

Dennis Handly — Sun, 05 Mar 2017 01:02:24 GMT

What do the exact errors look like?

Re: SSMC generating authentication failures

csbuxton — Mon, 06 Mar 2017 16:23:03 GMT

2017-03-03 01:09:11 CST        1 Informational   Authentication failure sw_cli     { 10.1.1.125 15179} {Authentication failure, reason: Invalid user (ssmc) or password}                                  {}
2017-03-03 01:10:14 CST        1 Informational   Authentication failure sw_cli     { 10.1.1.125 15220} {Authentication failure, reason: Invalid user (ssmc) or password}                                  {}
2017-03-03 12:38:41 CST        1 Informational   Authentication failure sw_cli     { 10.1.1.125 1848} {Authentication failure, reason: Invalid user (ssmc) or password} {}
2017-03-03 12:39:44 CST        1 Informational   Authentication failure sw_cli     { 10.1.1.125 1888} {Authentication failure, reason: Invalid user (ssmc) or password} {}

Re: SSMC generating authentication failures

Dennis Handly — Sun, 12 Mar 2017 04:48:10 GMT

> {Authentication failure, reason: Invalid user (ssmc) or password}

This says either the user doesn't exist or the password is invalid.

What does showuser show? And if not a local user, how have you set up LDAP on the array?

Re: SSMC generating authentication failures

ericbr007 — Wed, 15 Mar 2017 14:00:26 GMT

We are having the same issue with several Arrays alerting on the trigger "Authentication Failures". I believe I identified the issue but not sure, if it is the actual culprit. We have two (2) SSMC management consoles running on a primary/secondary server in different locations. We have a password policy change that requires us to change the 3paradm account once we have validated the system before entering it into PROD. We setup ldap before confirming the move into PROD but the problem I believe is due to the 3paradm account pw change. When the 3paradm account password is changed, the array disconnects from the SSMC and therefore forcing us to re-register the Array using the new 3paradm credentials. I’ve noticed that our team including I has been re-registering the Arrays on only one (1) system and not the other. I’m guessing that once we match up all accounts on both systems that this will hopefully resolve our problem or at least minimize the amount of alerts we get, hope this helps and if anyone has other solutions or ideas on this topic please share, I might need it, thanks again

Cheers.

Re: SSMC generating authentication failures

csbuxton — Mon, 08 May 2017 15:35:37 GMT

I ended up opening a ticket on this one with support and they were able to reproduce the issue in the lab. The solution is that the user you are connecting from SSMC with - 3paradm, or some other user with browse-only role, must have the same password on ALL arrays connected to SSMC. Our corporate standard generates a random password for every user on every array, so it would cause this issue. I have aligned my SSMC users and that has fixed the issue.

Re: SSMC generating authentication failures

Boobal — Thu, 31 Jan 2019 08:04:02 GMT

We are recieveing too much alerts mentioneing ""84 authentication failures in 120 sec" what does it refers too ? and we wont change our password once the default password is changed as per our standard. We are facing this issue before we migrated to SMMC as well and currently too, Please help us to resolve this issue.

Re: SSMC generating authentication failures

Sheldon Smith — Thu, 31 Jan 2019 15:43:53 GMT

@Boobal wrote:
We are recieveing too much alerts mentioneing ""84 authentication failures in 120 sec" what does it refers too ? and we wont change our password once the default password is changed as per our standard. We are facing this issue before we migrated to SMMC as well and currently too, Please help us to resolve this issue.

As you wrote "We are facing this issue before we migrated to SMMC",
please start a new topic.

As far as "what does it refer to"? Something attempting to access the 3PAR with out-of-date credentials.

Re: SSMC generating authentication failures

Dardan — Thu, 11 May 2023 13:42:48 GMT

Hello,

Had the same issue with a customer's array and the rootcause is easy to be determined by using CLI:
showeventlog -startt "2023-05-11 13:00" -endt "2023-05-11 14:41"
or
showeventlog -startt "2023-05-11 13:00" -endt "2023-05-11 14:41" -msg "Authentication failure"

i've created an article with detailed explanation and troubleshooting steps: 3PAR & PRIMERA AUTHENTICATION FAILURES IN SSMC

Hope this helps.
Cheers,
Dardan