# Remote Desktop: New connection has been rejected with reason: Authentication failed

**URL:** <https://discourse.openondemand.org/t/remote-desktop-new-connection-has-been-rejected-with-reason-authentication-failed/2749>\
**Category:** Get Help\
**Created:** [June 13, 2023, 6:38pm UTC](https://discourse.openondemand.org/t/remote-desktop-new-connection-has-been-rejected-with-reason-authentication-failed/2749 "2023-06-13T18:38:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![xpillons](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/xpillons/32/1256_2.png) [@xpillons](https://discourse.openondemand.org/u/xpillons)\
**Post date:** [June 13, 2023, 6:38pm UTC](https://discourse.openondemand.org/t/remote-desktop-new-connection-has-been-rejected-with-reason-authentication-failed/2749/1 "2023-06-13T18:38:18Z")

</div>

Hello all,  
How to troubleshoot the following error which happen when sharing the same node with several sessions ?

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/f/f1e51703a3879bfc841b7feca465a67cb692e238.png)  
This is using OOD 2.0.29 on CentOS 79  
This happen on Edge and Chrome browsers.  
I’ve tried to look at the logs of the session after we killed the job without success.  
Is there a way to increase some log verbosity or which logs should be checked other than the session one ?

Sometimes it’s also another error message “too many retries”, as explained in that ticket [Unable to connect to a Linux remote session : Authentication failed. Too many tries · Issue #865 · Azure/az-hop (github.com)](https://github.com/Azure/az-hop/issues/865)

Thank you,  
Xavier

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [June 13, 2023, 7:17pm UTC](https://discourse.openondemand.org/t/remote-desktop-new-connection-has-been-rejected-with-reason-authentication-failed/2749/2 "2023-06-13T19:17:32Z")

</div>

In your `output.log` do you see the message `Setting VNC password...` alot?

We reset the password every-time someone logs in. So any password is one time use only.

I suspect you seem to be rotating through them so quickly that the password in the view is the incorrect password.

Do you have some other mechanism that would login to this server and cause us to refresh the password before you (the user) can use it?

---

<div class="post-metadata">

**Author:** ![xpillons](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/xpillons/32/1256_2.png) [@xpillons](https://discourse.openondemand.org/u/xpillons)\
**Post date:** [June 14, 2023, 1:24pm UTC](https://discourse.openondemand.org/t/remote-desktop-new-connection-has-been-rejected-with-reason-authentication-failed/2749/3 "2023-06-14T13:24:47Z")

</div>

Thanks Jeff. In the output.log I can see a single `Setting VNC password...`  
And the password in the URL is the one the connection.yml  
The only suspicious messages are these ones

> WebSocket server settings:
> 
> - Listen on :61006
> - Flash security policy server
> - No SSL/TLS support (no cert file)
> - Backgrounding (daemon)  
> WARNING: no ‘numpy’ module, HyBi protocol will be slower  
> Traceback (most recent call last):  
> File “/usr/bin/websockify”, line 11, in  
> load\_entry\_point(‘websockify==0.8.0’, ‘console\_scripts’, ‘websockify’)()  
> File “/usr/lib/python2.7/site-packages/websockify/websocketproxy.py”, line 525, in websockify\_init  
> server.start\_server()  
> File “/usr/lib/python2.7/site-packages/websockify/websocket.py”, line 973, in start\_server  
> tcp\_keepintvl=self.tcp\_keepintvl)  
> File “/usr/lib/python2.7/site-packages/websockify/websocket.py”, line 741, in socket  
> sock.bind(addrs[0][4])  
> File “/usr/lib64/python2.7/socket.py”, line 224, in meth  
> return getattr(self.\_sock,name)(\*args)  
> socket.error: [Errno 98] Address already in use  
> Scanning VNC log file for user authentications…

I’m trying to understand where the `job_script_content.sh` is built so I can add more logs and tests in it. I’ve checked in `/var/www/ood/apps/sys/bc_desktop` but not all scripts are there.

---

<div class="post-metadata">

**Author:** ![xpillons](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/xpillons/32/1256_2.png) [@xpillons](https://discourse.openondemand.org/u/xpillons)\
**Post date:** [June 14, 2023, 4:25pm UTC](https://discourse.openondemand.org/t/remote-desktop-new-connection-has-been-rejected-with-reason-authentication-failed/2749/4 "2023-06-14T16:25:53Z")

</div>

I’ve an understanding of this issue. This is occuring on a VM being shared across multiple connections, and for which we are controlling the port range being used to only 10

> ```
> vnc:
> min_port: 61001
> max_port: 61010
> 
> ```

When a session is terminated either after the walltime expired, the session is deleted or the job is killed, there are remaining processes like the ones below

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/d/d1a991205df90a18eff3f7e0925fbe4635f983ce.png)

So those are accumulated over the time and at the end are exhausting the number of ports, hence the error message :

> socket.error: [Errno 98] Address already in use

so how to clean nicely all processes started by the remote session once the job is finished ? This is using OpenPBS. The most important seems to be the `websockify` one.

One more element, I don’t see any after.sh or clean.sh in the output session directory, maybe this is where this cleanup code should be added ? If so how ?

Thank you

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [June 14, 2023, 5:05pm UTC](https://discourse.openondemand.org/t/remote-desktop-new-connection-has-been-rejected-with-reason-authentication-failed/2749/5 "2023-06-14T17:05:08Z")

</div>

I’m not familiar with the PBS setting, but in Slurm I would point you to `ProctracType` and that you need to set it to `cgroup`.

PBS may be tracking processes’ it needs to clean by parent process ids. As such, these may not get captured because the parent process of some of this is 1 (systemd). These processes however, should still be a part of the jobs’ cgroup.

So cleaning processes by cgroup is better than by PPID.

[https://slurm.schedmd.com/slurm.conf.html#OPT\_ProctrackType](https://slurm.schedmd.com/slurm.conf.html#OPT_ProctrackType)

---

<div class="post-metadata">

**Author:** ![xpillons](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/xpillons/32/1256_2.png) [@xpillons](https://discourse.openondemand.org/u/xpillons)\
**Post date:** [June 20, 2023, 12:29pm UTC](https://discourse.openondemand.org/t/remote-desktop-new-connection-has-been-rejected-with-reason-authentication-failed/2749/6 "2023-06-20T12:29:26Z")

</div>

I confirmed that I’ve been able to solved this issue by :

- implementing the pbs\_cgroups hook (after backporting a fix done in 20.x to 19.x)
- installing nc as it was not there and the fallback mechanism to find port didn’t work when sharing the same machine across several users.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [December 17, 2023, 12:30pm UTC](https://discourse.openondemand.org/t/remote-desktop-new-connection-has-been-rejected-with-reason-authentication-failed/2749/7 "2023-12-17T12:30:13Z")

</div>

Closed on December 17, 2023, 12:30pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.