Intermittent login issues in Security Analytics

Products

• Security Analytics

Issue/Introduction

The Security Analytics appliance has been experiencing intermittent login issues which generate the following logs on user login failures:

"Authentication failed for example_username from 1.2.3.4 : Reason Code 2: Unknown User"

The passwords are correct on the majority of these login failures, and many failures occur before a login is successful.

Environment

Release : 8.2.4-55248

Cause

There was a timeout update problem with nscd.

Resolution

The solution is to add two lines to a couple of configuration files.

Run the following commands to update the nscd and ldap configuration files and restart nscd.

echo "nss_connect_policy oneshot" >> /etc/ldap.conf
echo "reload-count 0" >> /etc/nscd.conf
systemctl restart nscd

Additional Information

This will be fixed in 8.2.5.