VPM Generic Internal Error

[Steve Kadish]

Hi,

I got another "generic" VPM error immediately after a scheduled vulnerability scan had been submitted.

Unable to connnect to VPM scanner: "(500)Server Error"

The other web sites on the box are working. Three days ago, I installed ActiveState's Active Perl on the box. Perl and CGI documents are being parsed by Active Perl. Could there be any correlation?

Thanks,
- Steve

[Alexander Haugk]

i got an "VPM Generic Internal Error" too, but with the message:

Unable to connnect to VPM scanner: "Method: Anhinga::Soapbox::Mxpi::MxpiService::logon URL: https://SERVER:50001/mxsoap/services/MxpiMain4_2 Details: Failed while parsing the response. "

im awaiting a call from my local support center. if i get some answers, i will share it with you ;)

do you use the hpsim/vpm server for other web services? i think this is a bad idea. hpsim comes to you with its own webserver (a modified apache?), but vpm uses the IIS from microsoft. if you mess with the configuration of iis, you can crash your installation of vpm...

[Steve Kadish]

We have an IIS server which runs a number of applications and sites. We're not going to a dedicate a box to VPM; if it can't play nicely with others, then we can't use it.

Thanks,
- Steve

[Alexander Haugk]

i tried to use vpm on a iis server with other websites. i think it work. try it if you know what you are doing... ;)

[Alexander Haugk]

vpm is very funny... if i browse the url https://SERVER:50001/mxsoap/services/MxpiMain4_2 with my browser, ich get the following msg:

MxpiMain4_2
Hi there, this is an AXIS service!

Perhaps there will be a form for invoking the service here...

but if i browse https://SERVER:50001/mxsoap/services/MxpiMain4_2?wsdll, i get a lot of xml output...

[Rob Buxton]

VPM is proving to be a troublesome beast.

We updated one of our main Domain Admin passwords, one that VPM used. I thought I'd updated all references (SSH Service, VPM GUI, WBEM etc.) but now VPM fails with a "generic" error follow by a login failure. The rest of HPSIM is fine.
What login credentials it's using I've no idea!

I've also got IIS on the HPSIM box and ActiveState's perl. I had VPM working before the password change in this environment.
I use HPSIM and IIS to trigger perl scripts.
Ours is IIS 6.0.

[Rob Buxton]

Steve,
If it's any help my internal (or should that be infernal? ) generic error was resolved by a reboot. Seems as though somethingt was cached somewhere but I thought I'd restarted most services!

[Scott Shaffer]

I can't comment on all the things here but I can confirm that there is an issue with asp.net and VPM - basically they don't work together.

There also appears to be an issue (which means that we are investigating it) if you run RDP (Altiris Deployment Server) on the same system as VPM.

We're hoping to get a fix out for these issues soon. I wish I could give you a better ETA but in this case the problem lies with our partner's product. The good news is they are working it.

[Bernardo Tagariello]

https://SERVER:50001/mxsoap/services/MxpiMain4_2

is the HP SIM Apache / AXIS SOAP Web Service interface.

MxpiMain4_2
Hi there, this is an AXIS service!

It can be used to tell you alot, in particular if your internet settings are in order to do the operation you requested.

Those of us who use or create SOAP Web Services and Clients really need this.

https://SERVER:50001/mxsoap/services/MxpiMain4_2?wsdll

I create applications which validate the interface at runtime. Others may not care, but I do what my programs to make sure it is talking to the correct WEB service interface.

tag

[Bernardo Tagariello]

In response to:
------------------------------------------
VPM is proving to be a troublesome beast.

We updated one of our main Domain Admin passwords, one that VPM used.
------------------------------------------

In the documentation we outline the usage of the VPM Password change utility.

Perhaps you would try the:

Start>All Programs>HP Vulnerability and Patch Management Pack>Change VPM Credentials

tag

[Bernardo Tagariello]

In response to:
------------------------------------
"(500)Server Error"
------------------------------------

We are going to look at that.
My best guess: IIS Error 500 from IIS V6.0

Using Google, I found this:

------------------------------------
IIS Error - 500 when running a CGI/EXE after upgrading XP to SP2

After upgrading my XP tro SP2, my CGI app no longer works. I get an IIS -
500 error when I try to run my CGI/EXE in the same manner I always have as
such:

http://MyServer/MyVD/MyApp.exe

I know Microsoft has identified this as a BUG with SP2, and has made a
series of workarounds, but I can not find them. I've searched with "IIS 500
EXE CGI" and many various derivations of that string, but I can't find the
steps.
------------------------------------

This does look like the way we access the VPM scanner. Could you provide more details about your Software Environment on what version of the Operating system, and what services packs and hot fixes which may effect IIS. Also the versions of the additional software which may have interacted or modified the IIS configuration.

tag

[Bernardo Tagariello]

Below is one approach:

1) Uninstall STAT Scanner WSI.

MsiExec.exe /qn /X{C8A5336E-815A-45E5-BABD-3D19900261F8} /Lmoe! Uninstall.log

2) Install without SSL : \Harris\STATScannerWSI.exe /s /v" SSL=SKIP /Lmoe! Install.log"

--or--

Install with SSL: \Harris\STATScannerWSI.exe /s /v" /Lmoe! Install.log"

I assume they install it in the default location: c:\program files\HP\VPM\Harris.

This should overwrite any incompatible configuration on their IIS. If something goes wrong with the installation, I would like the "Install.log".

tag

[Bernardo Tagariello]

Another thought:

SP2 does indeed impact the security. It is either taking away the privelege
for IUSR and IWAM to "Create Token Objects" and/or adding a new privilege
called "Create Token Objects" (which I doubt, and could easily determine, but
don't have the time to), of which it is not adding IUSR and IWAM to. I
confirmed this by simply adding IUSR and IWAM to have that privilege and then
IIS and CGI worked.

tag

[Steve Kadish]

Bernardo, Scott, et al,

Thanks for all the input. I have opened a ticket with HP support on this issue. VPM is installed on a shared IIS server with a number of different Web applications which our company uses. I am checking with the other application owners to see which use ASP.NET and if they have made recent changes.

If the investigation continues to go in that direction, we will either move VPM to another server or wait for HP's patches.

Thanks,
- Steve

[Rob Buxton]

Steve,
Did you open a call with HP with just the 2 default VPM licenses or have you purchased additional ones.
I'm thinking of opening a call but I only have the 2 free licenses.

[Steve Kadish]

Hi Rob,

We haven't purchased additional licenses. We'd like to, but I need to make sure that VPM is stable first. The question never came up when I opened the call, though.

- Steve

[James D. Young]

I have been having problems with my VPM as well. Mine started a little different, in that it would not load. Working with HP we found that it would not work with a password that had special characters in it. I have $'s in mine.

I changed the password, installed vpm, then change the password back. VPM Still does not work, I know HP is working on it, not sure when the fix will be out.

I can not get any scans, they all show as aborted. And I get emails for HPSim saying login error.

Still working with HP to hopefully solve this.

[Steve Kadish]

Hi all,

Magically, my VPM scanner started working again . The scans on my two licensed servers were successful on the 21st and today. I also just did a patch validation, which succeeded including a rollback of one patch.

I have nothing to offer here, except that both the CMS and the VPM server were rebooted on the 18th. Other than that, everyone is pleading innocence on making any changes to the servers.

Thanks,
- Steve

[Jim Walsh_2]

im having the exact same issue as steve was having, also if i go to this url

if i browse https://SERVER:50001/mxsoap/services/MxpiMain4_2?wsdll

i get a 400 error, but if i remove the things after the comma, its ok, sim 4.2 sp2, windows 2003, no sp