Re: Local Security Checks for OSX 10.4 and 10.5 broken
Renaud Deraison <[email protected]> Thu, 6 Nov 2008 11:50:33 +0100
| Newsgroups | gmane.comp.security.nessus.general |
|---|---|
| Message-ID | <[email protected]> |
Hi Ron, We can not reproduce your problem here (tested against 10.5.5 with both password authentication and public key authentication). Are you doing a key authentication or a password-based one? If it's a public key authentication, i'd be interested in seeing the format of the public key you're using (you can send it to me privately) Thanks, -- Renaud On Nov 6, 2008, at 12:07 AM, Ron wrote: > I am supporting a sysadmin with 70 OSX workstations and servers. I > have installed Nessus 3.2.1 client and server on the admin host. I > can reliability perform a Local Security Check on some OSX boxes and > not others.. They are all either Tiger (10.4.11) or Leopard > (10..5.5). I have tried both SSH username/passwords and public/ > private keys authentication with identical results. In addition, I > can always connect with "ssh" directly with either username/password > and Pub/private keys. > > Even though my "ssh/sshd" is current (OpenSSH 5.1), possibly Nessus > itself is using it's own "ssh" client internal to Nessus itself. > Maybe there is a problem there. > > I think I have followed the "Nessus Credential Checks for Unix and > Windows" exactly. But obviously something is wrong. I'm open to > any ideas. > > Thanks > > Ron > [email protected] > ---------------------------------------------------------------------------------------------------------------------------------------------------------- > > Here's a dump of the failed login from /var/log/secure.log using PKI > > Nov 5 10:57:47 clusterg4-350-5 sshd[2952]: reverse mapping checking > getaddrinfo for host.company.netl [172.17.119.27] failed - POSSIBLE > BREAK-IN ATTEMPT! > Nov 5 10:57:47 clusterg4-350-5 sshd[2952]: Accepted publickey for > zeus from 172.17.119.27 port 61466 ssh2 > Nov 5 10:57:47 clusterg4-350-5 sshd[2952]: error: BSM audit: > bsm_audit_session_setup: setaudit_addr failed: Function not > implemented > Nov 5 11:01:41 clusterg4-350-5 sshd[2958]: Did not receive > identification string from 172.17.119.27 > Nov 5 11:01:41 clusterg4-350-5 sshd[2959]: Did not receive > identification string from 172.17.119.27 > Nov 5 11:01:41 clusterg4-350-5 sshd[2960]: Did not receive > identification string from 172.17.119.27 > Nov 5 11:01:42 clusterg4-350-5 sshd[2961]: Did not receive > identification string from 172.17.119.27 > Nov 5 11:01:42 clusterg4-350-5 sshd[2962]: Did not receive > identification string from 172.17.119.27 > Nov 5 11:01:43 clusterg4-350-5 sshd[2963]: Did not receive > identification string from 172.17.119.27 > Nov 5 11:01:44 clusterg4-350-5 sshd[2964]: Did not receive > identification string from 172.17.119.27 > Nov 5 11:01:44 clusterg4-350-5 sshd[2965]: Did not receive > identification string from 172.17.119.27 > Nov 5 11:02:14 clusterg4-350-5 sshd[2969]: Did not receive > identification string from 172.17.119.27 > Nov 5 11:02:34 clusterg4-350-5 sshd[2976]: Protocol major versions > differ for 172.17.119.27: SSH-2.0-OpenSSH_5.1 vs. SSH-9.9- > NessusSSH_1.0 > Nov 5 11:02:34 clusterg4-350-5 sshd[2978]: Protocol major versions > differ for 172.17.119.27: SSH-2.0-OpenSSH_5.1 vs. SSH-1.33- > NessusSSH_1.0 > Nov 5 11:02:34 clusterg4-350-5 sshd[2980]: Protocol major versions > differ for 172.17.119.27: SSH-2.0-OpenSSH_5.1 vs. SSH-1.5- > NessusSSH_1.0 > Nov 5 11:02:44 clusterg4-350-5 sshd[2975]: Did not receive > identification string from 172.17.119.27 > Nov 5 11:02:45 clusterg4-350-5 sshd[2995]: Protocol major versions > differ for 172.17.119.27: SSH-2.0-OpenSSH_5.1 vs. SSH-9.9- > NessusSSH_1.0 > Nov 5 11:02:45 clusterg4-350-5 sshd[2996]: Protocol major versions > differ for 172.17.119.27: SSH-2.0-OpenSSH_5.1 vs. SSH-1.33- > NessusSSH_1.0 > Nov 5 11:02:45 clusterg4-350-5 sshd[2997]: Protocol major versions > differ for 172.17.119.27: SSH-2.0-OpenSSH_5.1 vs. SSH-1.5- > NessusSSH_1.0 > Nov 5 11:03:14 clusterg4-350-5 sshd[3001]: Did not receive > identification string from 172.17.119.27 > Nov 5 11:03:14 clusterg4-350-5 sshd[3002]: Did not receive > identification string from 172.17.119.27 > ---------------------------------------------------------------------------------------------------------------------------------------------------------- > Here's a dump from from a successful pki login > > Nov 5 10:57:30 Schillingmac sshd[7092]: Accepted publickey for scan > from 172.17.119.27 port 61362 ssh2 > Nov 5 10:57:30 Schillingmac sshd[7092]: error: BSM audit: > bsm_audit_session_setup: setaudit_addr failed: Function not > implemented > Nov 5 10:57:35 Schillingmac sshd[7096]: Protocol major versions > differ for 172.17.119.27: SSH-2.0-OpenSSH_5.1 vs. SSH-9.9- > NessusSSH_1.0 > Nov 5 10:57:35 Schillingmac sshd[7099]: Protocol major versions > differ for 172.17.119.27: SSH-2.0-OpenSSH_5.1 vs. SSH-1.33- > NessusSSH_1.0 > Nov 5 10:57:35 Schillingmac sshd[7100]: Protocol major versions > differ for 172.17.119.27: SSH-2.0-OpenSSH_5.1 vs. SSH-1.5- > NessusSSH_1.0 > Nov 5 10:57:36 Schillingmac sshd[7097]: reverse mapping checking > getaddrinfo for host.company.net [172.17.119.27] failed - POSSIBLE > BREAK-IN ATTEMPT! > Nov 5 10:57:36 Schillingmac sshd[7103]: reverse mapping checking > getaddrinfo for host.company.net [172.17.119.27] failed - POSSIBLE > BREAK-IN ATTEMPT! > Nov 5 10:57:36 Schillingmac com.apple.SecurityServer: authinternal > failed to authenticate user root. > Nov 5 10:57:36 Schillingmac com.apple.SecurityServer: Failed to > authorize right system.login.tty by process /usr/sbin/sshd for > authorization created by /usr/sbin/sshd. > Nov 5 10:57:37 Schillingmac sshd[7097]: Failed password for root > from 172.17.119.27 port 61368 ssh2 > Nov 5 10:57:37 Schillingmac sshd[7107]: reverse mapping checking > getaddrinfo for host.company.net [172.17.119.27] failed - POSSIBLE > BREAK-IN ATTEMPT! > Nov 5 10:57:37 Schillingmac sshd[7108]: reverse mapping checking > getaddrinfo for host.company.net [172.17.119.27] failed - POSSIBLE > BREAK-IN ATTEMPT! > Nov 5 10:57:37 Schillingmac sshd[7108]: Invalid user from > 172.17.119.27 > Nov 5 10:57:37 Schillingmac sshd[7108]: Failed none for invalid > user from 172.17.119.27 port 61378 ssh2 > Nov 5 10:57:37 Schillingmac sshd[7095]: Did not receive > identification string from 172.17.119.27 > Nov 5 10:57:37 Schillingmac com.apple.SecurityServer: authinternal > failed to authenticate user root. > Nov 5 10:57:37 Schillingmac com.apple.SecurityServer: Failed to > authorize right system.login.tty by process /usr/sbin/sshd for > authorization created by /usr/sbin/sshd. > > _______________________________________________ > Nessus mailing list > [email protected] > http://mail.nessus.org/mailman/listinfo/nessus _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus