topic Re: failed admin login attempt NOT recorded in system log in General Topics

topic Re: failed admin login attempt NOT recorded in system log in General Topics https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23068#M16831 <HTML><HEAD></HEAD><BODY><P>I'm running 4.1.8-1 and attempted login via ssh as 'admin' and 'root' and received syslog for both failed attemps as shown below.</P><P></P><P>2012/10/19 20:37:54info     general        auth-fa 0  User 'admin' failed authentication.  Reason: Invalid username/password From: 172.16.20</P><P>.24.</P><P>2012/10/19 20:37:51info     general        general 0  User root</P><P> failed authentication from 172.16.20.24</P></BODY></HTML> Sat, 20 Oct 2012 03:41:07 GMT gswcowboy 2012-10-20T03:41:07Z failed admin login attempt NOT recorded in system log https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23067#M16830 <HTML><HEAD></HEAD><BODY><P>During a routine test,  we found out if failed attempt login with the admin name as root via ssh or console will not record to system log, but failedd  attempt login with other name via ssh or console will record to system log.</P></BODY></HTML> Sat, 20 Oct 2012 03:36:22 GMT https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23067#M16830 nextgenhappines 2012-10-20T03:36:22Z Re: failed admin login attempt NOT recorded in system log https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23068#M16831 <HTML><HEAD></HEAD><BODY><P>I'm running 4.1.8-1 and attempted login via ssh as 'admin' and 'root' and received syslog for both failed attemps as shown below.</P><P></P><P>2012/10/19 20:37:54info     general        auth-fa 0  User 'admin' failed authentication.  Reason: Invalid username/password From: 172.16.20</P><P>.24.</P><P>2012/10/19 20:37:51info     general        general 0  User root</P><P> failed authentication from 172.16.20.24</P></BODY></HTML> Sat, 20 Oct 2012 03:41:07 GMT https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23068#M16831 gswcowboy 2012-10-20T03:41:07Z Re: failed admin login attempt NOT recorded in system log https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23069#M16832 <HTML><HEAD></HEAD><BODY><P>Are you using external authentication profile?  In my testing,  I am only using the local database.  I am not using any external authentication profile.  </P></BODY></HTML> Sat, 20 Oct 2012 12:59:24 GMT https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23069#M16832 nextgenhappines 2012-10-20T12:59:24Z Re: failed admin login attempt NOT recorded in system log https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23070#M16833 <HTML><HEAD></HEAD><BODY><P>No auth profile. I'm using the built in administrator 'admin' account in addition to the others listed below.</P><P></P><P>admin@renato(active)> show admins all</P><P></P><P>admin</P><P>panorama</P><P>oliver</P><P></P><P>As you can see, the following is a list of my local users not utilized for administrative logon accounts. Maybe we could take a closer look at your system to see the anomaly first hand?</P><P></P><P>admin@renato(active)# show shared local-user-database user</P><P>  homeadmin   homeadmin</P><P>  renato      renato</P><P>  ryan        ryan</P><P></P><P></P><P>login as: root</P><P>Using keyboard-interactive authentication.</P><P>Password:</P><P>Access denied</P><P>Using keyboard-interactive authentication.</P><P>Password:</P><P>Access denied</P><P>Using keyboard-interactive authentication.</P><P>Password:</P><P></P><P>login as: oliver</P><P>Using keyboard-interactive authentication.</P><P>Password:</P><P>Access denied</P><P>Using keyboard-interactive authentication.</P><P>Password:</P><P></P><P>login as: panorama</P><P>Using keyboard-interactive authentication.</P><P>Password:</P><P>Access denied</P><P>Using keyboard-interactive authentication.</P><P>Password:</P><P></P><P>Time           Severity Subtype Object EventID ID Description</P><P>===============================================================================</P><P>2012/10/20 09:59:08info     general        general 0  User root</P><P> failed authentication from 172.16.20.24</P><P>2012/10/20 09:58:38info     general        general 0  User root</P><P> failed authentication from 172.16.20.24</P><P>2012/10/20 09:58:08info     general        general 0  User panorama</P><P> failed authentication from</P><P>2012/10/20 09:58:00info     general        auth-fa 0  User 'panorama' failed authentication.  Reason: Invalid username/password From: 172.16</P><P>.20.24.</P><P>2012/10/20 09:57:55info     userid         connect 0  ldap cfg pa200 connected to server 172.16.20.7:389, initiated by: 172.16.20.254</P><P>2012/10/20 09:57:38info     general        general 0  User oliver</P><P> failed authentication from</P><P>2012/10/20 09:57:19info     general        auth-fa 0  User 'oliver' failed authentication.  Reason: Invalid username/password From: 172.16.2</P><P>0.24.</P></BODY></HTML> Sat, 20 Oct 2012 17:08:13 GMT https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23070#M16833 gswcowboy 2012-10-20T17:08:13Z Re: failed admin login attempt NOT recorded in system log https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23071#M16834 <HTML><HEAD></HEAD><BODY><P>ernest@PA-200> show admins all</P><P></P><P>panorama</P><P>ernest</P><P></P><P>ernest@PA-200> </P><P></P><P>ernest@PA-200> show config running </P><P></P><P>config {</P><P>  mgt-config {</P><P>    users {</P><P>      ernest {</P><P>        permissions {</P><P>          role-based {</P><P>            superuser yes;</P><P>          }</P><P>        }</P><P>        authentication-profile admin-local-ap;</P><P>      }</P><P>    }</P><P>  }</P><P></P><P>    authentication-profile {</P><P>      admin-local-ap {</P><P>        method {</P><P>          local-database;</P><P>        }</P><P>        allow-list all;</P><P>        lockout {</P><P>          lockout-time 5;</P><P>          failed-attempts 3;</P><P>        }</P><P>      }</P><P>    }</P><P></P><P>PA-200 login: root</P><P>Password: </P><P>Login incorrect</P><P></P><P></P><P>login: root</P><P>Password: </P><P>Login incorrect</P><P></P><P></P><P>login: root</P><P>Password: </P><P>Login incorrect</P><P></P><P></P><P>login: root</P><P>Password: </P><P></P><P>ernest@PA-200> show log system direction equal backward </P><P>Time                Severity Subtype Object EventID ID Description</P><P>===============================================================================</P><P>2012/10/20 13:04:06 info     general        general 0  User ernest logged in via CLI from </P><P>2012/10/20 13:04:05 info     general        auth-su 0  User 'ernest' authenticated.   From: (null).</P><P>2012/10/20 13:03:06 info     general        general 0  User ernest logged out via CLI from Console</P><P>2012/10/20 13:01:02 info     general        general 0  User ernest logged in via CLI from </P><P>2012/10/20 13:01:01 info     general        auth-su 0  User 'ernest' authenticated.   From: (null).</P><P></P><P>no log of root at all..</P></BODY></HTML> Sat, 20 Oct 2012 20:16:54 GMT https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23071#M16834 nextgenhappines 2012-10-20T20:16:54Z Re: failed admin login attempt NOT recorded in system log https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23072#M16835 <HTML><HEAD></HEAD><BODY><P>No auth profile associated with this admin user so to mimic your config, I added the local user 'renato' as an administrator and using the localdb as my auth profile for said user. I still see syslogs for the 'root' user. Only difference I see with our config is that the 'admin' user is configured on my unit whereas it's not on yours. </P><P></P><P></P><P>renato@renato(active)> show admins all</P><P></P><P></P><P>admin</P><P>panorama</P><P>oliver</P><P>renato</P><P></P><P>config {</P><P>  mgt-config {</P><P>    users {</P><P>      admin {</P><P>      permissions {</P><P>          role-based {</P><P>            superuser yes;</P><P>          }</P><P>        }</P><P></P><P> renato {</P><P>        permissions {</P><P>          role-based {</P><P>            superuser yes;</P><P>          }</P><P>        }</P><P>        authentication-profile LocalDB;</P><P>      }</P><P>    }</P><P>  }</P><P>2012/10/20 16:05:45info     general        general 0   Accepted keyboard-interactive/pam for renato from 172.16.20.24 port 6960 ssh2</P><P>2012/10/20 16:05:39info     general        auth-fa 0  User 'renato' failed authentication.  Reason: Invalid username/password From: 172.16.20.24.</P><P>2012/10/20 16:05:27info     general        general 0  User renato logged in via CLI from 172.16.20.24</P><P>2012/10/20 16:05:26info     general        auth-su 0  User 'renato' authenticated.   From: 172.16.20.24.</P><P>2012/10/20 16:05:15info     general        general 0  User root</P><P> failed authentication from 172.16.20.24</P></BODY></HTML> Sat, 20 Oct 2012 23:10:37 GMT https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23072#M16835 gswcowboy 2012-10-20T23:10:37Z Re: failed admin login attempt NOT recorded in system log https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23073#M16836 <HTML><HEAD></HEAD><BODY><P>Hmm,  not sure what to say, but I tested with 4.1.7 and 5.0.0 beta.   </P></BODY></HTML> Sun, 21 Oct 2012 22:28:55 GMT https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23073#M16836 nextgenhappines 2012-10-21T22:28:55Z Re: failed admin login attempt NOT recorded in system log https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23074#M16837 <HTML><HEAD></HEAD><BODY><P>Call into PAN Support so we can turn on some debugging features. If indeed a bug, we'll file one accordingly and investigate further.     </P></BODY></HTML> Mon, 22 Oct 2012 00:22:21 GMT https://live.paloaltonetworks.com/t5/general-topics/failed-admin-login-attempt-not-recorded-in-system-log/m-p/23074#M16837 gswcowboy 2012-10-22T00:22:21Z