topic Re: What's this mean with "<login>" a/c in break-in record? in Operating System - OpenVMS

What's this mean with "" a/c in break-in record?

Davor_7 — Fri, 28 Oct 2005 03:41:53 GMT

Hi expert,

i analyze the breakin record and find that many records' username are marked as ""
i have no idea about this information, who knows it?

thanks

Re: What's this mean with "" a/c in break-in record?

Vladimir Fabecic — Fri, 28 Oct 2005 03:58:34 GMT

For example:
You establish a connection and get "Username". You do not enter username, timeout period expires and connection is disconnected.
Usually this means that no username was entered when connection was estableshed.
You can also have this kind of record when someone scan your VMS system with some kind of port scaner.

Re: What's this mean with "" a/c in break-in record?

Daniel Fernandez Illan — Fri, 28 Oct 2005 05:28:49 GMT

Davor
Some years ago, I had a similar problem, a lot of breaking marked as login. The problem was induced by a serial device - TX type - who sended request to a VAX box and produced a failure on multiplexor box.
You can check intrusion (SHO INTRUSION) command and discover if break records are produced by a particular device.
Saludos.
Daniel.

Re: What's this mean with "" a/c in break-in record?

Davor_7 — Fri, 28 Oct 2005 06:36:31 GMT

thanks,
but... after my test.
if you try to manually break in the system, you can still get the "" report even if you enter a username each time.
further more, i found that not all the login failure record can be analysed from event log...
anybody know this problem? (maybe called bug?)

Re: What's this mean with "" a/c in break-in record?

Ian Miller. — Fri, 28 Oct 2005 08:19:10 GMT

Are you looking at the audit log or accounting or something else?

Re: What's this mean with "" a/c in break-in record?

Mike Reznak — Fri, 28 Oct 2005 09:17:49 GMT

Davor,

do you mean this record from audit file?

Auditable event: Local interactive login failure
Event time: 27-OCT-2005 19:07:43.67
PID: 2D17558A
Process name: _VTA1661:
Username:
Process owner: [SYSTEM]
Terminal name: _VTA1661, Host: 10.155.155.155 Port: 2039
Image name: $1$DGA2500:[SYS0.SYSCOMMON.][SYSEXE]LOGINOUT.EXE
Posix UID: -2
Posix GID: -2 (%XFFFFFFFE)
Status: %LOGIN-F-CMDINPUT, error reading command input

If it is so, then you can achieve it this way
(Don't write any username)

MYHOST> set host 0

Unauthorised Access is PROHIBITED

Username:
Error reading command input
Timeout period expired
%REM-S-END, control returned to node MYHOST::

Mike

Re: What's this mean with "" a/c in break-in record?

Mike Reznak — Fri, 28 Oct 2005 09:23:31 GMT

Just to add something.
You can still see the source host or device, from which the login was attempted.
Usually its caused just by no action by user.
Sometimes it's caused by unsteady network traffic (corrupted frames) or faulty or wrongly configured terminal device.
Or it can by some type of network scanning.

Mike

Re: What's this mean with "" a/c in break-in record?

comarow — Fri, 28 Oct 2005 09:52:10 GMT

Can you show your error?

Re: What's this mean with "" a/c in break-in record?

Davor_7 — Fri, 28 Oct 2005 10:33:04 GMT

Mike et all,

that's the audit log, you are right

but i have not tested what you suggest :)

Re: What's this mean with "" a/c in break-in record?

Willem Grooters — Mon, 31 Oct 2005 04:39:23 GMT

tells there has been an incomplete login attempt. most ofetn exprired input, that is: something VMS would see as such. In principle, a bad line to a terminal port could cause this: each signal on that line would be seen as unsollicited input and trigger the login sequence. that obviously times out and writes the event.
If it from the same terminal line, that line is suspect to be bad in this respect.
You can also check the accounting file for login failures; also check opator.log on the event - the system may have been set up to use accounting and operator for siganllin login events.

Willem

Re: What's this mean with "" a/c in break-in record?

Davor_7 — Mon, 31 Oct 2005 04:45:45 GMT

thanks Willem

but as a matter of fact.from my test, i input wrong username/password for 9 times continuously. and get the analysis report from event log. it shows 8:1 (8 times have the right username, but 1 time is sdisplayed ""), furthermore, the password sometimes is not the same as i input. how to explain such result?

Re: What's this mean with "" a/c in break-in record?

Wim Van den Wyngaert — Mon, 31 Oct 2005 06:02:02 GMT

Tested it on 7.3.

1. Accounting.

Timeout on username :
Timeout on password :
Invalid username :
Correct username + incorrect password : the correct username

I got only 1 accounting record for each set host command (even if 3 times a username was entered). Only the last action is written (e.g. timeout after invalid username is timeout).

SSH based login may react differently.

2. Audit.

The username and password as entered was shown in the breakin records. What I think is bad. No password should be revealed to the system manager (if you see "secrey" you may guess that the password is "secret").
In the login failure records, was shown when the username was invalid. No password was ever shown.

Wim

Re: What's this mean with "" a/c in break-in record?

Davor_7 — Mon, 31 Oct 2005 06:11:37 GMT

Wim,

the last sentence " was shown when the username was invalid."

but my result is if the username was invalid, it still showed in the audit log, with the error:"%status ... no such user"

in summary, i think there are many uncertain factors in VMS. hope my found is wrong...

Re: What's this mean with "" a/c in break-in record?

Wim Van den Wyngaert — Mon, 31 Oct 2005 06:22:37 GMT

Davor,

Was your record marked "login failure" on the first line of the audit report ?
If it is "breakin" your findings are as expected (always shows the info).

Wim

Re: What's this mean with "" a/c in break-in record?

Davor_7 — Mon, 31 Oct 2005 07:08:33 GMT

it shows:
Remote interactive login failure
or
Remote interactive breakin detection

Re: What's this mean with "" a/c in break-in record?

Ian Miller. — Mon, 31 Oct 2005 10:21:10 GMT

the argument for including the incorrect password in the audit record is that this may help you with determining what the person attempting to login is doing. e.g If you see a pattern in the passwords used it may indicate a systematic attempt to login.

Re: What's this mean with "" a/c in break-in record?

Davor_7 — Mon, 31 Oct 2005 19:53:47 GMT

Millar,
you mean that it should be reasonable due to system designation?

Re: What's this mean with "" a/c in break-in record?

Jan van den Ende — Fri, 04 Nov 2005 15:18:21 GMT

Davor,

from your Forum Profile:

I have assigned points to 85 of 108 responses to my questions.

It looks like you mostly have some older streams unassigned.

Maybe you can find some time to do some assigning?

http://forums1.itrc.hp.com/service/forums/helptips.do?#33

Mind, I do NOT say you necessarily need to give lots of points. It is fully up to _YOU_ to decide how many. If you consider an answer is not deserving any points, you can also assign 0 ( = zero ) points, and then that answer will no longer be counted as unassigned.
Consider, that every poster took at least the trouble of posting for you!

To easily find your streams with unassigned points, click your own name somewhere.
This will bring up your profile.
Near the bottom of that page, under the caption â My Question(s)â you will find â questions or topics with unassigned points â Clicking that will give all, and only, your questions that still have unassigned postings.

Thanks on behalf of your Forum colleagues.

PS. â nothing personal in this. I try to post it to everyone with this kind of assignment ratio in this forum. If you have received a posting like this before â please do not take offence â none is intended!

Proost.

Have one on me.

jpe

Re: What's this mean with "" a/c in break-in record?

Ian Miller. — Sat, 05 Nov 2005 17:01:20 GMT

Davor,
you said "you mean that it should be reasonable due to system designation?"

Can you rephrase this question because I don't understand what you are asking.

Re: What's this mean with "" a/c in break-in record?

Davor_7 — Tue, 08 Nov 2005 21:52:36 GMT

close it
thanks!