Technical Tip: The fnbamd daemon crashes in v7.4.4 causing LDAP administrator accounts to fail to log in

1. After upgrading FortiGate to v7.4.4, LDAP administrator accounts in FortiGate fail to log in. 
2. fnbamd: Handles remote user authentication (LDAP, RADIUS, FortiToken, etc.) as well as x.509 certificate verification.  
3. To check the issue. Run the CLI command to check:

diagnose debug crashlog read

It will show the result as below:

3087: 2024-05-15 15:19:00 <06970> firmware FortiGate-2601F v7.4.4,build2662b2662,240514 (GA.F) (Release)

3088: 2024-05-15 15:19:00 <06970> application fnbamd

3089: 2024-05-15 15:19:00 <06970> *** signal 11 (Segmentation fault) received ***

3090: 2024-05-15 15:19:00 <06970> Register dump:

3091: 2024-05-15 15:19:00 <06970> RAX: 0000000000000000   RBX: 0000000000000000

3092: 2024-05-15 15:19:00 <06970> RCX: 00007f48f0c480bd   RDX: 0000000000002dde

3093: 2024-05-15 15:19:00 <06970> R08: 00007f48ed7c8000   R09: 0000000000000001

3094: 2024-05-15 15:19:00 <06970> R10: 0000000000000008   R11: 0000000000000246

3095: 2024-05-15 15:19:00 <06970> R12: 00000000101731f4   R13: 0000000000000001

3096: 2024-05-15 15:19:00 <06970> R14: 00007fff3b90c170   R15: 0000000000000001

3097: 2024-05-15 15:19:00 <06970> RSI: 0000000000000000   RDI: 00000000101731f4

3098: 2024-05-15 15:19:00 <06970> RBP: 00007fff3b90c0c0   RSP: 00007fff3b90c0a0

3099: 2024-05-15 15:19:00 <06970> RIP: 0000000000cfeb20   EFLAGS: 0000000000010206

3100: 2024-05-15 15:19:00 <06970> CS:  0033   FS: 0000   GS: 0000

3101: 2024-05-15 15:19:00 <06970> Trap: 000000000000000e   Error: 0000000000000004

3102: 2024-05-15 15:19:00 <06970> OldMask: 0000000000000000

3103: 2024-05-15 15:19:00 <06970> CR2: 0000000000000024

3104: 2024-05-15 15:19:00 <06970> stack: 0x7fff3b90c0a0 - 0x7fff3b92bc00

3105: 2024-05-15 15:19:00 <06970> Backtrace:

3106: 2024-05-15 15:19:00 <06970> [0x00cfeb20] => /bin/fnbamd 

3107: 2024-05-15 15:19:00 <06970> [0x00d000e6] => /bin/fnbamd 

3108: 2024-05-15 15:19:00 <06970> [0x00d0de6d] => /bin/fnbamd 

3109: 2024-05-15 15:19:00 <06970> [0x00d135ff] => /bin/fnbamd 

3110: 2024-05-15 15:19:00 <06970> [0x02ed84a9] => /bin/fnbamd 

3111: 2024-05-15 15:19:00 <06970> [0x00d25ed7] => /bin/fnbamd 

3112: 2024-05-15 15:19:00 <06970> [0x004509df] => /bin/fnbamd 

3113: 2024-05-15 15:19:00 <06970> [0x00456248] => /bin/fnbamd 

3114: 2024-05-15 15:19:00 <06970> [0x00456a3a] => /bin/fnbamd 

3115: 2024-05-15 15:19:00 <06970> [0x004592bf] => /bin/fnbamd 

3116: 2024-05-15 15:19:00 <06970> [0x00459d77] => /bin/fnbamd 

3117: 2024-05-15 15:19:00 <06970> [0x7f48f0c32deb] => /usr/lib/x86_64-linux-gnu/libc.so.6

3118: 2024-05-15 15:19:00 (__libc_start_main+0x000000eb) liboffset 00023deb

3119: 2024-05-15 15:19:00 <06970> [0x0044c1ca] => /bin/fnbamd 

3120: 2024-05-15 15:19:00 <06970> fortidev 6.0.1.0005

3121: 2024-05-15 15:19:00 the killed daemon is /bin/fnbamd: status=0xb00

3122: 2024-05-15 15:19:40 the killed daemon is /bin/fnbamd: status=0x0

3123: 2024-05-15 15:20:24 fnbamd previously crashed 1 times. The last crash was at 2024-05-15 15:19:00.

To fix:

For a permanent fix, it is necessary to upgrade the FortiGate to FortiOS v7.4.9/v7.6.4 and above.

Related articles:

• Troubleshooting Tip: FortiGate LDAP troubleshooting and debug logs created by fnbamd 
• Technical Tip: LDAPS/STARTTLS certificate issuer enforcement