Invalid Username/Password via SSL (but it's not...)

[Tech127 20]

I can log into my server remotely from either a firestick or the iphone app.  Any OTHER user can not. I tried creating a test account with a super simple lowercase password and nothing. Changed one of the kid's passwords to short and simple and still no. This is using https://my.webserver.net:443 (which is the only way to connect). It will display the user pictures, but that's as far as you can get unless you're me. My account (Smokey) works. Exact same device, connection, everything. I just pressed back, chose me, put in my password and voila.

I recently moved from Untangle to pfSense. I don't know if that is significant to this issue. I'm just trying to mention any/everything I can think of. So basically it works like this:

remote user device (firestick / ios app) -> https://my.server.net:443 -> Cloudflare -> pfSense with all Clouflare IP's whitelisted, accepting connections on any port from whitelisted IP -> 111.222.333.444 running NGINX -> Emby

Again, it works fine for me, but no one else no matter what I do. I *think* this only happened since the pfSense switch, but why would that allow me but not others if it is pfSense freaking out?

Log attached. What you're looking for is at the very bottom.

embyserver.txt

Edited August 9, 2022 by TechLife

[Luke 42085]

Hi, can we please see the emby server log from an iOS example? Thanks.

[Tech127 20]

So apparently Sonya can from her Roku cuz she's on right now. Favor, Scrat, and Chase can't though.

Here's the log:

embyserver (1).txt

[Tech127 20]

Long story, but I switched back to Untangle. Loaded, restored config, everything is now exactly the same as it was and still no one except me and Sonya can log in. Thoughts?

[Luke 42085]

16 minutes ago, TechLife said:

Long story, but I switched back to Untangle. Loaded, restored config, everything is now exactly the same as it was and still no one except me and Sonya can log in. Thoughts?

I don't know. I see the requests in your server log and they look like legitimately wrong username/password combinations.

A common cause of this is confusing the Emby Connect login system vs. the local users on your personal Emby Server. So maybe the others are trying to use Emby Connect credentials on your server.

[Tech127 20]

Thanks, Luke. None of them have Emby accounts and I'm the one testing so I know it isn't a Connect attempt. That being said, I am going to try to create an Emby account for my daughter, add that info in the dashboard, verify local login, then try remotely and see if that works. I'm not against using connect. I've just been too lazy to set it up for them. (And yes, I know it's been years lol)

[rbjtech 5284]

Have to agree with Luke - all the failed/denied attempts have been with emby connect.

Connectivity to your remote host is good (I can connect at an IP layer) so I think it's either a local user configuration issue or the clients have been set to use emby connect rather than a direct remote host.  

I would also disable/remove the Portmap plugin as presumably you are doing direct port forwarding on your router/firewalls ?

Edited August 12, 2022 by rbjtech