Troubleshooting

This chapter contains troubleshooting step for various functions of the Hawkeye Server. It also covers how to install additional tools to extend troubleshooting capabilities.

LDAP

Logs

LDAP actions and errors are logged as part of Hawkeyes Authentication Logging. This log file can be found in /opt/hawkeye/logs/Hawkeye/Authentication.log

The following are example logs showing what is logged in various scenarios:

Bad password or if the user was not found.

[2021-02-05 14:58:27.596624 UTC] (index) Bind failed: Invalid credentials

[2021-02-05 14:58:27.596733 UTC] (index) Could not connect using remote authentication server - Invalid credentials LDAP redirecting to login

User exists in ldap but is not a member of the group configured in preferences.

[2021-02-06 03:32:07.955771 UTC] (index) LDAP Group based authentication - start

[2021-02-06 03:32:08.014499 UTC] (index) Trying to bind with -

[2021-02-06 03:32:08.017528 UTC] (index) Found 1 LDAP group entries for filter (cn=QualityControl)

[2021-02-06 03:32:08.018546 UTC] (index) Found 1 LDAP user entries for filter (|(cn=devtester))

[2021-02-06 03:32:08.018616 UTC] (index) LDAP devtester matches the cn in LDAP element returned - devtester

[2021-02-06 03:32:08.018753 UTC] (index) User not in authorized group. LDAP redirecting to login

Generate packet captures

To generate a pcap to ensure traffic is leaving the expected interface with the correct ports assigned, do the following:

  1. Ssh to the Hawkeye console as ksuser.
  2. Execute the following command to capture a pcap trace of an openLDAP login.

# tcpdump 636 or 389 -I eth0 -w /tmp/openLDAP_trace.pcap

  1. While the trace is running, attempt logging into Hawkeye.
  2. Terminate capture with <ctrl>-C
  3. Transfer the pcap trace to another computer and view the pcap trace file in Wireshark.