VPM will not scan a licensed Server

[Rob Buxton]

I'm having problems getting the Vulnerability Scanning to work consistently.

Two Servers licensed, the CMS and a SQLServer box. Both are HP Proliant DL380 G3's with Windows 2003. Both are in the domain, so the credentials should be the same.
All attempts to scan the CMS Box work.
Only occasional attempts to scan the SQLServer box work, the error I see is:
Explanation: No file or registry access.

I've tried changing the WBEM from Global to specific but it make no difference. Probably about 1 out of 5 attempts works and then I get the full reports. It can be just time has passed between success and failure, i.e. I've made no changes.
I've also tried scheduling the job as well as run now. Same result.

[Rob Buxton]

Additional Info.
From the rpm.log file on the SQL Server I see:

20050105 13:36:54 Warning: REXECD/10.x.x.x.1327: connection reset, whilst reading callback

I tried restarting all 4 of the Radia Services on the SQL Server box. The following

Information was generated which may have been from the Radia Management agent.

Event Type: Information
Event Source: rma
Event Category: None
Event ID: 1
Date: 5/01/2005
Time: 1:31:52 p.m.
User: N/A
Computer: SQLDBPR1
Description:
The description for Event ID ( 1 ) in Source ( rma ) cannot be found. The local computer

may not have the necessary registry information or message DLL files to display messages

from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this

description; see Help and Support for details. The following information is part of the

event: Service Starting.

From the STATScannerDebug.log file on the VPM Server:

00000034 13:38:08.157 [10080] adminTool::connectToResource: \\10.x.x.x\admin$,

Access is denied.
00000035 13:38:38.360 [10080]

adminTool::runHaveWinRegistryAccess:RegConnectRegistry: \\10.x.x.x, Access is denied.
00000036 13:38:53.844 [8900] CScanMgr::ReportTotallySecureMachines: Determing if

any machines are secure.

Interestingly I'm getting a number of sshd events on the VPM Server during the time the

task is running.
I have not installed SSH on the SQL Server, but I did not believe that was a pre-requisite.

I can't understand how it could have worked if that's the case. Excample of the event.

Event Type: Information
Event Source: sshd
Event Category: None
Event ID: 0
Date: 1/5/2005
Time: 2:03:03 PM
User: WCC\xxxxxxxaccount
Computer: ITSMPR1
Description:
The description for Event ID ( 0 ) in Source ( sshd ) cannot be found. The local computer

may not have the necessary registry information or message DLL files to display messages

from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this

description; see Help and Support for details. The following information is part of the

event: sshd : PID 9068 : input_userauth_request: illegal user WCC\\xxxxxxaccount.

There's also a logon event for Anonymous around the same time on the SQL Server box.

In WBEM, the account is setup as above; e.g. domain\account
The password is correct, I can login to the Server using these account credentials and map

to the file share that the VPM appears to be targetting.

I tried to reinstall the VPM Agent, which seemed to go okay, but there was an unusual event

during configuration.
The initial scheduling went okay, but I then wanted to change the Run As User. When I went

back in, okayed the Selected Server it then said HPSIM had been unable to determine the OS

and to select an OS but gave no options to select.

From all of the above I believe the HPSIM/VPM somehow think the remote Server is a

non-Windows Server and attempt to connect via SSH which has not been installed on the

Server.
All recent attempts to get a successful scan are now failing so I'm not too sure what has

changed. My guess is that it is something on the HPSIM/VPM Server side as it seems to be

that that is making the SSH connection.

[Steve Kadish]

Hi Rob,

I noticed this in your event log message:

"illegal user WCC\\xxxxxxaccount."

Notice the double slash. While I was struggling with SSH myself, I noticed this. If the "" in the tool defs was in the form of "DOMAIN\user", the SSH client would try to connect as "DOMAIN\\user".

This struck me as probably being a Unix-world to Windows-world translation issue, so I stopped trying to use domain users in my tool defs and stuck to local users.

My suggestion would be that you look at the VPMTool.xml file in your \tools\ directory and change all the fields to use a local acocunt which an account in the passwd files.

Good luck,
- Steve

[Rob Buxton]

Steve,
Thanks for the input.
I'll look at what you've suggested.
I'm not sure why it should be using SSH, from the docs it suggests that VPM doesn't use this for windows clients.

[Rob Buxton]

Hmmm...
If I configure the WBEM for the remote Server to use an account that is in the SSH passwd file as a domain account but specify it by it's SSH name (i.e no domain prefix) then it works in the same manner as if I supply a local account.
In both cases the WBEM credentials do not have a preceding domain qualifier.

Looks like I might need to read up a bit more on WBEM and how credentials should be added. I'm not sure if this is my misunderstanding of how credentials should be added into WBEM or VPM misusing the credentials.

So the following WBEM Credentials:
domain\domainaccount (where domainaccount is in passwd file) - does not work for VPM
localaccount - works
domainaccount (in passwd file) - works
domainaccount (not in passwd file) - works
domain\domainaccount (not in passwd file) - works

[David Claypool]

Let me try and sort through a couple of things that are confusing...

VPM uses SSH locally and with the target server.

However, the STAT scanner portion uses remote procedure calls (might be through DCOM but I have to validate) rather than WBEM/WMI or SSH. Rather than create another setup page in HP SIM for you to enter usernames and passwords, since a WBEM password is a password to validate to the OS, the VPM team decided to grab the info out of the first and second WBEM entries for Windows and Linux respectively. If in fact you want to use a different account for WBEM than you do for VPM (assuming Windows) then put the VPM-oriented account in the first entry and the WBEM/WMI one in the third entry.

[Bernardo Tagariello]

Do these systems have multiple NICs in different subnets?

Is there a single DNS validating these network names and addresses.

[Rob Buxton]

No, nothing complex like that. Single configured NIC, same subnet.

[Bernardo Tagariello]

VPM does use SSH.

[Rob Buxton]

It's confusing as the results are not predictable.
I've now reverted to the settings I was using earlier but I still get the failures on the remote Server.
SSH has never been on the Remote Server, but I have performed successful scans of that Server.
I'm retesting, I'll also run Identification tasks and leave a bit of time in between each test to try and remove any overlaps.
I've set the WBEM to use the Local not Global settings.

[Rob Buxton]

Okay more fun.
I set WBEM to use the "specified versions below" and set those as just account (no domain prefix). This account has is a domain account and resides in the passwd file as a domain account.
Reran the Device Identification task for the Server , rechecked the System Protocols and found the WBEM entry had been changed to domain\account.
Changed the WBEM to use a local Admin Account and reran the device Identification task.
Rechecked the System Protocol settings and these were retained. Ran the VPM and it worked okay.
VPM will not work with the domain\account format above, but does work with a local account.

[Bernardo Tagariello]

Does the domain\account have the right to
login to the targets you are scanning and is a member of the local target system's administrative group?

[Rob Buxton]

Yes, the Domain Account I've entered into the WBEM details is the one we do all of our Admin work from. I can certainly Map to the Admin$ Share that VPM tries to use using that account from the HPSIM Server.
I'm confused as to why running the Identification Task for the Server changes the details in the System Protocols box from the simple account format to the domain\account format.

[Steve Kadish]

Just a side note...

David mentioned that Harris STAT might use DCOM. If this turns out to be the case, it would be ironic, since one of the conditions which Harris flags as a warning is "DCOM Enabled." Just think that following the recommendations of the scanner could disable the scanner itself. I hope not!

- Steve