Invalid Authentication from AWS

Third party integrations
1

Every few seconds, I’m getting the below error in my logs. It is always from us-west-2.compute.amazonaws.com but the IP may vary.

I assume it’s from Alexa, as I do have many integrations (HA Cloud, Alexa Media Player, Custom Skills) but I have been able to successfully reconnect them all, and they all seem to be working. I also tried restarting HA but no luck. I don’t know how long this has gone on as I had to restart HA yesterday due to the daylight savings bug.

Any ideas where this could be coming from, or how to track it down?

2021-11-08 16:12:13 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from ec2-34-213-114-230.us-west-2.compute.amazonaws.com (34.213.114.230). (Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36)

2

Also FYI, I enabled debug logging on homeassistant.components.http.ban, but it does not show any more information.

3

Hrm, it slowed, and then seems to have stopped. Nothing in 24 hours, and I didn’t do anything in that time.

Is it possible people were trying to brute force hack in via AWS? I wish this HA gave more information (destination URL, username…anything)…

4

Thanks anyway.

5

I have the same issue here, many failed login attempt from AWS (ec2).
But they seems to be linked to my own connections, when i launch ha, there are failed login attempt at the same time.
Can we raise the log level somehow to see what those request / login attempt look like ? They might be legit and fail because of bad credentials on my own.
This had increased a lot for the last 4 days.

image
image1691×260 60.6 KB 

Logger: homeassistant.components.http.ban
Source: components/http/ban.py:124
Integration: HTTP (documentation, issues)
First occurred: 21 décembre 2021, 11:58:49 (371 occurrences)
Last logged: 20:56:51

Login attempt or request with invalid authentication from ec2-34-219-160-7.us-west-2.compute.amazonaws.com (34.219.160.7). (Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36)
Login attempt or request with invalid authentication from ec2-54-188-134-36.us-west-2.compute.amazonaws.com (54.188.134.36). (Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36)
Login attempt or request with invalid authentication from ec2-34-212-106-246.us-west-2.compute.amazonaws.com (34.212.106.246). (Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36)
Login attempt or request with invalid authentication from ec2-34-212-199-25.us-west-2.compute.amazonaws.com (34.212.199.25). (Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36)
Login attempt or request with invalid authentication from ec2-54-203-0-143.us-west-2.compute.amazonaws.com (54.203.0.143). (Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36)`Preformatted text`
6

I had zero luck tracking this down. It still happens to me, but not as bad as it did those few days. It also seems to go a couple of days without any and then some days it happens a lot.

I tried upping the log level on that ban component, but didn’t get any more information. It would be great if we could get any more information that would help understand where they are coming from. As you say it very well may be legit but I haven’t noticed anything not work or anything like that, so I don’t know.

And as you can see, nobody provided any least bit of assistance.

7

have the same issue when my alexa aws lambda function wants to access HA with the provided token. I can not successfully allow the IP behind as these are dynamic … any ideas?

8

I have this same issue. I have narrowed it down to Alexa Actionable Notifications but still haven’t been able to determine why it is not authenticating as I have alexa local and all is fine in that department. They are both set the same so I am puzzled

9

And just as I finished typing my reply I have located the solution in another post.

if your cause is actionable notifications or even alexa local double check your LLAT in both. with Actionable notifications I never did add a long lived access token but I guess something somewhere along the way changed and as soon as I added the token it started working again and the unable to authenticate error went away. FYI when check the lambda_function.py script open it from the side menu not just the top or you may not see the code where you need to place the token. good luck guys

Hope this helps

1 Like
10

Thanks! I don’t use Actionable Notifications, so maybe not exactly my problem. However, you may be onto something. I do use the built in Alexa integration with intents, and I just verified that it’s not supposed to need a LLAT. But I do get the “There was a problem with the requested skills response” on occasion, and have never figured that out either. So maybe it has a glitch sometimes and fails to authenticate? Hrm…

11

As I stated Actionable Notifications and or Alexa Local. so you might want to look into it just a suggestion

12

I live in Europe, and linking the Alexa App to HA using https://layla.amazon.com/ fail with the following error message:

[homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.1.1 (192.168.1.1). Requested URL: '/auth/login_flow/..... bla...bla...bla

But if I use the US client_ID: https://pitangui.amazon.com/ then linking is successful with no more error messages. But sadly, it fails to discover any new devices! Why is it that the US link works and not the European Link? And how can I debug the fact that it doesn’t discover any new devices when there are no trace anywhere from it’s attempt to do so? No log entries, nothing. Is it possible to enable extra logging in HA to catch the connection steps to see where it fails?

Show less