<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \,serif";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
tt
{mso-style-priority:99;
font-family:"Courier New";}
p.imprintuniqueid, li.imprintuniqueid, div.imprintuniqueid
{mso-style-name:imprintuniqueid;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Jules,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">No, I didn’t type in < and > characters. I only did that to not show real usernames on my end. So to be clear, no I did not type in those characters as part of the username when using the /opt/zendto/bin/adduser
command. As for certificates, I’m not sure as our DNS server is actually managed by our MSP. With that said, when I do run the openssl command, I get the below output.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">As for the log file at /var/log/zendto/zendto.log, if it says Warning: authorization failed for username, does that mean it wasn’t able to read from our AD Server. Not sure how to interpret that because before
I ran the upgrade command after applying the latest patch, it seemed as though it was able to read from AD. Now I’m not sure what’s going on.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><u><span style="color:#1F497D">Output for </span></u><tt><b><u><span style="font-size:10.0pt">openssl s_client -connect your-ad-server.company.com:636</span></u></b></tt><u><span style="color:#1F497D"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">CONNECTED(00000003)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">write:errno=104<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">---<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">no peer certificate available<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">---<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">No client certificate CA names sent<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">---<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">SSL handshake has read 0 bytes and written 283 bytes<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Verification: OK<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">---<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">New, (NONE), Cipher is (NONE)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Secure Renegotiation IS NOT supported<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Compression: NONE<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Expansion: NONE<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">No ALPN negotiated<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Early data was not sent<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Verify return code: 0 (ok)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Jules [mailto:Jules@Zend.To] <br>
<b>Sent:</b> Wednesday, July 15, 2020 12:35 PM<br>
<b>To:</b> Marlon Deerr <MDeerr@hshlawyers.com>; ZendTo Users <zendto@zend.to><br>
<b>Subject:</b> Re: [ZendTo] Authentication Error - The username or password was incorrect<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Are you actually seeing the < and > characters?<br>
You didn't actually type those into the /opt/zendto/bin/adduser command, did you?<br>
<br>
Have a read of the AD troubleshooting steps on<br>
<tt><span style="font-size:10.0pt"> zend.to/activedirectory</span></tt><br>
<br>
Do you know if you're running with a locally-signed certificate on your AD servers?<br>
<br>
Assuming you have the hostname and port number (636 usually) of your AD server, try<br>
<tt><b><span style="font-size:10.0pt">openssl s_client -connect your-ad-server.company.com:636</span></b></tt><br>
<br>
That will show you the initial SSL/TLS handshake involving all the certificates.<br>
You'll need to Ctrl-C it at the end, but what it prints out should be very useful so you can see exactly what is using which certs.<br>
<br>
Hope that helps,<br>
Jules.<span style="font-size:12.0pt"><o:p></o:p></span></p>
<div>
<p class="MsoNormal">On 15/07/2020 16:50, Marlon Deerr wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="color:#1F497D">OK, my user seems to be unlocked now but now I am getting the following errors below. I must be missing something else in my setup:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Warning: admin authorization failed for <username1></span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">And for other users I still get the following error:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Warning: authorization failed for <username2></span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Note: I believe I added <username1> as an admin.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><o:p> </o:p></span></p>
<p class="imprintuniqueid"><b><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#17365D">Marlon Deerr</span></b>,
<b><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#17365D">Technology Manager</span></b><br>
<span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#17365D">416-572-8795</span><span style="color:#17365D"> </span><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#17365D">(direct)</span><span style="color:#17365D">
|</span> <span style="font-size:9.0pt;font-family:"Helvetica",sans-serif"><a href="mailto:MDeerr@hshlawyers.com" title="Click to send
email to Marlon Deerr">MDeerr@hshlawyers.com</a></span><br>
<a href="https://www.hshlawyers.com"><span style="text-decoration:none"><img border="0" width="624" height="82" id="_x0000_i1025" src="cid:image002.jpg@01D65C5C.D501A610"></span></a>
<o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="80%" style="width:80.82%;border-collapse:collapse">
<tbody>
<tr style="height:20.25pt">
<td width="115" style="width:86.25pt;padding:0in 0in 0in 0in;height:20.25pt">
<p class="MsoNormal"><a href="https://www.linkedin.com/company/howie-sacks-&-henry-llp---personal-injury-law/"><span style="text-decoration:none"><img border="0" width="24" height="23" id="_x0000_i1026" src="cid:image004.jpg@01D65C5C.D501A610"></span></a> <a href="https://twitter.com/hshlawyers"><span style="text-decoration:none"><img border="0" width="24" height="23" id="_x0000_i1027" src="cid:image006.jpg@01D65C5C.D501A610"></span></a> <a href="https://www.facebook.com/HSHPersonalInjuryLawyers/"><span style="text-decoration:none"><img border="0" width="24" height="23" id="_x0000_i1028" src="cid:image008.jpg@01D65C5C.D501A610"></span></a> <a href="https://www.youtube.com/user/hshlawyers"><span style="text-decoration:none"><img border="0" width="24" height="23" id="_x0000_i1029" src="cid:image010.jpg@01D65C5C.D501A610"></span></a><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><o:p></o:p></span></p>
</td>
<td width="458" style="width:353.25pt;padding:0in 0in 0in 0in;height:20.25pt">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif;color:#002060">3500 - 20 Queen St. W., Toronto, ON M5H 3R3<br>
Fax: 416-361-0083 | Toll Free: 877-474-5997</span><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif"> |
<a href="https://www.hshlawyers.com" title="">www.hshlawyers.com</a></span><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="imprintuniqueid"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="100%" style="width:100.0%;border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0in 0in 0in 0in">
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Helvetica",sans-serif;color:#3F3F3F">This Howie Sacks & Henry e-mail is privileged, confidential and subject to copyright. Any unauthorized use or disclosure is prohibited.</span><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="imprintuniqueid" style="margin-bottom:12.0pt"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif"> <o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Jules [<a href="mailto:Jules@Zend.To">mailto:Jules@Zend.To</a>]
<br>
<b>Sent:</b> Wednesday, July 15, 2020 7:09 AM<br>
<b>To:</b> ZendTo Users <a href="mailto:zendto@zend.to"><zendto@zend.to></a><br>
<b>Cc:</b> Marlon Deerr <a href="mailto:MDeerr@hshlawyers.com"><MDeerr@hshlawyers.com></a><br>
<b>Subject:</b> Re: [ZendTo] Authentication Error - The username or password was incorrect<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Marlon,<br>
<br>
The crucial bit in the log is the "locked-out user" bit.<br>
<br>
ZendTo has a security feature in it to stop it being used as a method of brute-force attacking your accounts from outside.<br>
If the same user has several failed logins in a row, that user is locked out for the next 24 hours by default.<br>
<br>
If you can login as an admin user, one of the extra admin red buttons shows you the locked out users and lets you reset them.<br>
<br>
Alternatively, you can unlock all locked users from the command line with<br>
/opt/zendto/bin/unlockuser -a<br>
<br>
Cheers,<br>
Jules.<o:p></o:p></p>
<div>
<p class="MsoNormal">On 14/07/2020 18:45, Marlon Deerr via ZendTo wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span lang="EN-CA">Ok, so I think I finally (or almost finally) got my AD authentication settings correct. I have installed the ldapsearch utility to confirm that I’m able to successful search the OU where my users reside, however when
I attempt to log in with a valid user, ZendTo keeps erroring with:</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">Authentication Error</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">The username or password was incorrect</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">I checked the /var/log/zendto/zendto.log and it says the following:</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">“….Warning: authorization attempt for locked-out user <username1></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">Then when I try logging in as another user, I see the following in the log
</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">“…Warning: authorization failed for <username2></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA">I know that I have both username/password correct so I must be missing something. Anyone know what setting I may have applied incorrectly?</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-CA"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman ,serif",serif"><br>
<br>
<br>
</span><o:p></o:p></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>ZendTo mailing list<o:p></o:p></pre>
<pre><a href="mailto:ZendTo@zend.to">ZendTo@zend.to</a><o:p></o:p></pre>
<pre><a href="http://jul.es/mailman/listinfo/zendto">http://jul.es/mailman/listinfo/zendto</a><o:p></o:p></pre>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman ,serif",serif"><br>
<br>
<br>
</span><o:p></o:p></p>
<pre>Jules<o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre>-- <o:p></o:p></pre>
<pre>Julian Field MEng CEng CITP MBCS MIEEE MACM<o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre>'When a man points a finger at someone else, he should remember<o:p></o:p></pre>
<pre> that four of his fingers are pointing at himself.' - Louis Nizer<o:p></o:p></pre>
<pre> <o:p></o:p></pre>
<pre><a href="http://www.Zend.To">www.Zend.To</a><o:p></o:p></pre>
<pre>Twitter: @JulesFM<o:p></o:p></pre>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><br>
<br>
<o:p></o:p></span></p>
<pre>Jules<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>-- <o:p></o:p></pre>
<pre>Julian Field MEng CEng CITP MBCS MIEEE MACM<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>'There is silent poetry in the stillness of morning;<o:p></o:p></pre>
<pre> in the calm, the cries & sighs of life sound like gentle music.'<o:p></o:p></pre>
<pre> - @Astro_Wheels<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><a href="http://www.Zend.To">www.Zend.To</a><o:p></o:p></pre>
<pre>Twitter: @JulesFM<o:p></o:p></pre>
</div>
</body>
</html>