OpenNebula 6.0 Authentication stopped working

I think the problem is related with a Fireedge vulnerability fixed in 6.0.0.1 (EE 6.0.1 and CE 6.0.0.1 Available for Download).

In order to recover your environment please stop opennebula-fireedge service, update oneadmin user and remove the LOGIN_TOKEN section:

UPDATE user_pool SET body = '<USER><ID>0</ID><GID>0</GID><GROUPS><ID>0</ID></GROUPS><GNAME>oneadmin</GNAME><NAME>oneadmin</NAME><PASSWORD><![CDATA[a560f64750a7b82e630e56e560744e20f23b7adcbe4d44b186bb1189cf4e04cd]]></PASSWORD><AUTH_DRIVER><![CDATA[core]]></AUTH_DRIVER><ENABLED>1</ENABLED><TEMPLATE><SSH_PUBLIC_KEY><![CDATA[ssh-rsa **********************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************== lippdefault]]></SSH_PUBLIC_KEY><SUNSTONE><DEFAULT_VIEW><![CDATA[admin]]></DEFAULT_VIEW><LANG><![CDATA[en_US]]></LANG><TABLE_DEFAULT_PAGE_LENGTH><![CDATA[100]]></TABLE_DEFAULT_PAGE_LENGTH></SUNSTONE><TOKEN_PASSWORD><![CDATA[5d659e8d58d1d9f1fe6faf807ae9864cd47497740939f93d3e5e0d66c8a804ff]]></TOKEN_PASSWORD></TEMPLATE></USER>' WHERE oid = 0;

(remember to put the right ssh key again in the query above)

After that, please update to the newest version 6.0.0.1 to make sure the error doesn’t happen again. After the upgrade you should be able to start the fireedge service again.

Also, I suggest to check all your users and remove every token that have been created automatically by OpenNebula. If you’re not using tokens you can run oneuser token-delete-all <username> to make sure every token is removed.