User having issues authenticating with webauthn method

[pedrompcaetano]

Dear Eurotux fellows,

Today we've experienced an error with users attempting to authenticate via WebAuthn method.

We're running an updated rocky 8 instance with latest release from etux rpm repository.

Linux vpn1.x.x.pt 4.18.0-553.47.1.el8_10.x86_64 #1 SMP Thu Apr 3 14:27:08 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

# rpm -qa | grep etv
etvpn-nginx-uwsgi-0.7.5-1.el8.noarch
etvpn-0.7.5-1.el8.noarch
etvpn-uwsgi-0.7.5-1.el8.noarch
etvpn-web-0.7.5-1.el8.noarch

Analyzing logfiles it seems web component and uwsgi component fell out of sync.
The most evident error in logs uwsgi complaining inability to remove old authentication requests generated by uwsgi component.

vpn1 uwsgi[1108]: etvpn webauthn [x.x.x.x]: error loading authorize session eefa3d5599d5c82723aaf1efa2a497b007091853b72d2ef0: flush(): couldn't remove session data: remove(): couldn't unlink '/var/lib/etvpn/cgi-sessions/authorize/cgisess_026d2472925094cec470cb417fdb8658c5d678c31b57cc6c': No such file or directory

Forcing failover to backup node resumed service without any issues.

Apologies for my incomplete bug report, please lmk what further information is needed to proceed debugging this issue.

Best regards,
Pedro Caetano

[araujorm]

Hello.

Can you please check if the directory exists, and it's permissions, by sharing the output of the following command on the affected server?

ls -ld /var/lib/etvpn/cgi-sessions/authorize

Also, can you tell us if SELinux was in enforcing mode when that happened?

[pedrompcaetano]

Hi,

[root@vpn1 ~]# ls -ld /var/lib/etvpn/cgi-sessions/authorize
drwxrws---. 2 root etvpnwww 6 Apr 10 16:47 /var/lib/etvpn/cgi-sessions/authorize
[root@vpn1 ~]# sestatus 
SELinux status:                 disabled

[araujorm]

@pedrompcaetano All of that looks well, and with SELinux out of the equation, we'll need a more close approach but this public discussion may not be suitable for that. If you agree, we'll deal with this directly with you to try to find the best way to diagnose this. Please check your messages.

[araujorm]

Meanwhile we'll leave this issue open and update it when we have relevant information to add here.