(and what can I do about it?)
When we run Open-AudIT Server on Windows and try to discover the IP that the server is using, we will not get a meaningful result - why is this?
When discovery runs it has no idea that the IP it is attempting to talk to is actually the local machine. It is treated just like any other IP. This means we will attempt to connect to it, over the "network", using credentials.
WMI simply does not support doing this. No credentials we supply will work, because they will be rejected by WMI on the local machine.
You can try this for yourself by running the below command on your Open-AudIT Server. Obviously substitute the IP, username, domain and password.
| Code Block |
|---|
wmic /Node:"YOUR-IP" /user:"YOUR_DOMAIN\YOUR_USERNAME" /password:"YOUR_PASSWORD" csproduct get uuid |
The result you get will be as below.
| Code Block |
|---|
Node - 192.168.88.73 ERROR: Description = User credentials cannot be used for local connections |
And you can see this in the discovery log when we attempt to connect using WMI (ID 375 below). We don't actually retrieve a result, even with valid credentials.
So how can we audit the Open-AudIT Server?
The best option right now is to setup a scheduled task to run the audit script or to run it manually when you need to.
If you have a Collector that is able to reach the server using the required network ports, you could have that collector discover the server.
We have this as an outstanding item to be addressed in a future release.
This issue has been outstanding for a very long time, but with the work-around in place, it is not crucial to the function of Open-AudIT.
When running a discovery that includes the IP of the local server, you will receive very limited data from, the discovery but you will receive the FQDN and the MAC address. Between these two items and the default match settings, no extraneous devices will be created.
| 06/08/19 09:05 | 343 | 127.0.0.1 | start | Discovery for 192.168.88.73 submitted for discovery 3 starting |
| 06/08/19 09:05 | 344 | 127.0.0.1 | notice | Starting discovery for 192.168.88.73 |
| 06/08/19 09:05 | 345 | 127.0.0.1 | notice | Discovery for 192.168.88.73 using Nmap version 7.60 at C:\Program Files (x86)\Nmap\nmap.exe |
| 06/08/19 09:05 | 346 | 127.0.0.1 | notice | IPs in subnet: 1 Command: C:\Program Files (x86)\Nmap\nmap.exe -n -sL 192.168.88.73 |
| 06/08/19 09:05 | 347 | 127.0.0.1 | notice | IPs after exclusions in subnet: 1 Command: C:\Program Files (x86)\Nmap\nmap.exe -n -sL 192.168.88.73 |
| 06/08/19 09:05 | 348 | 127.0.0.1 | notice | IPs responding to Nmap ping in subnet (to be scanned): 1 Command: C:\Program Files (x86)\Nmap\nmap.exe -n -oG - -sP 192.168.88.73 |
| 06/08/19 09:05 | 349 | 192.168.88.73 | notice | Scanning Host: 192.168.88.73 |
| 06/08/19 09:05 | 350 | 192.168.88.73 | notice | Nmap Command Command: C:\Program Files (x86)\Nmap\nmap.exe -n -T4 -sS -p T:22,135,62078 192.168.88.73 :: Custom TCP Ports |
| 06/08/19 09:05 | 351 | 192.168.88.73 | notice | Host 192.168.88.73 is up, received ssh (TCP port 22 open) response Command: C:\Program Files (x86)\Nmap\nmap.exe -n -T4 -sS -p T:22,135,62078 192.168.88.73 :: Custom TCP Ports Output: 22/tcp open ssh |
| 06/08/19 09:05 | 352 | 192.168.88.73 | notice | Host 192.168.88.73 is up, received wmi (TCP port 135 open) response Command: C:\Program Files (x86)\Nmap\nmap.exe -n -T4 -sS -p T:22,135,62078 192.168.88.73 :: Custom TCP Ports |
| 06/08/19 09:05 | 353 | 192.168.88.73 | notice | Command: C:\Program Files (x86)\Nmap\nmap.exe -n -T4 -sU -p U:161 192.168.88.73 :: Custom UDP Ports |
| 06/08/19 09:05 | 354 | 192.168.88.73 | notice | Scanning localhost, so setting WMI status to true Command: C:\Program Files (x86)\Nmap\nmap.exe -n -T4 -sU -p U:161 192.168.88.73 :: Custom UDP Ports |
| 06/08/19 09:05 | 355 | 192.168.88.73 | (1 of 1) | IP 192.168.88.73 responding, ping reply, adding to device list. SSH Status: true, WMI Status: true, SNMP Status: false. Command: http://127.0.0.1/open-audit/index.php/input/discoveries |
| 06/08/19 09:05 | 356 | 192.168.88.73 | success | The discovery_id was used to successfully retrieve information for the discovery entry named local |
| 06/08/19 09:05 | 357 | 192.168.88.73 | success | Received data for 192.168.88.73, now starting to process |
| 06/08/19 09:05 | 358 | 192.168.88.73 | success | IP 192.168.88.73 resolved to DNS hostname hel |
| 06/08/19 09:05 | 359 | 192.168.88.73 | notice | Running devices::match function. |
| 06/08/19 09:05 | 360 | 192.168.88.73 | notice | Not running match_hostname_uuid, uuid not set. |
| 06/08/19 09:05 | 361 | 192.168.88.73 | notice | Not running match_hostname_dbus, dbus_identifier not set. |
| 06/08/19 09:05 | 362 | 192.168.88.73 | notice | Not running match_hostname_serial, serial not set. |
| 06/08/19 09:05 | 363 | 192.168.88.73 | notice | Not running match_dbus, matching rule set to: n. |
| 06/08/19 09:05 | 364 | 192.168.88.73 | success | HIT on fqdn. Output: FQDN: hel.opmantek.com |
| 06/08/19 09:05 | 365 | 192.168.88.73 | success | Device with ID 2 found on initial Nmap result. |
| 06/08/19 09:05 | 366 | 192.168.88.73 | success | Delete the previous log entries for this device Command: /* input::discoveries */ DELETE FROM discovery_log WHERE system_id = 2 and discovery_id != 3 |
| 06/08/19 09:05 | 367 | 192.168.88.73 | success | Update the current log entries with our new device Command: /* input::discoveries */ UPDATE discovery_log SET system_id = 2 WHERE discovery_id = 3 and ip = '192.168.88.73' |
| 368 | 192.168.88.73 | notice | WMI Status is true on 192.168.88.73 | |
| 06/08/19 09:05 | 369 | 192.168.88.73 | notice | SSH Status is true on 192.168.88.73 |
| 06/08/19 09:05 | 370 | 192.168.88.73 | notice | SNMP Status is false on 192.168.88.73 |
| 06/08/19 09:05 | 371 | 192.168.88.73 | notice | SSH audit starting |
| 06/08/19 09:05 | 372 | 192.168.88.73 | warning | SSH detected but no valid SSH credentials for 192.168.88.73. |
| 06/08/19 09:05 | 373 | 192.168.88.73 | notice | Testing Windows credentials for 192.168.88.73 |
| 06/08/19 09:05 | 374 | 192.168.88.73 | notice | Windows credentials starting |
| 06/08/19 09:05 | 375 | 192.168.88.73 | notice | Attempting to execute command Command: %comspec% /c start /b wmic /Node:"192.168.88.73" /user:"hel\administrator" /password:"*******" csproduct get uuid Output: ["",""] |
| 06/08/19 09:05 | 376 | 192.168.88.73 | notice | Credential set for Windows named local admin not working on 192.168.88.73 |
| 06/08/19 09:05 | 377 | 192.168.88.73 | warning | WMI detected but no valid Windows credentials for 192.168.88.73. |
| 06/08/19 09:05 | 378 | 192.168.88.73 | notice | MAC (input) matched to manufacturer |
| 06/08/19 09:05 | 379 | 192.168.88.73 | notice | Start of NMAP update for 192.168.88.73 |
| 06/08/19 09:05 | 380 | 192.168.88.73 | notice | Formatting system details |
| 06/08/19 09:05 | 381 | 192.168.88.73 | notice | End of NMAP update for 192.168.88.73 |
| 06/08/19 09:05 | 382 | 192.168.88.73 | notice | Processing found ip addresses (non-snmp) for 192.168.88.73 |
| 06/08/19 09:05 | 383 | 192.168.88.73 | notice | Updating ip with ID 7 |
| 06/08/19 09:05 | 384 | 192.168.88.73 | notice | Processing Nmap ports for 192.168.88.73 |
| 06/08/19 09:05 | 385 | 192.168.88.73 | notice | At IP 192.168.88.73, discovery found an unknown device. |
| 06/08/19 09:05 | 386 | 192.168.88.73 | fail | No valid credentials for 192.168.88.73 |
| 06/08/19 09:05 | 387 | 192.168.88.73 | notice | Audit result incoming from target. |
| 06/08/19 09:05 | 388 | 192.168.88.73 | notice | Discovery has completed processing 192.168.88.73 . |
| 06/08/19 09:05 | 389 | 192.168.88.73 | success | IP 192.168.88.73 has successfully been sent to the server. Discovery script continuing to next IP. Command: Status: 200 URL: http://127.0.0.1/open-audit/index.php/input/discoveries Output: Response: |
| 06/08/19 09:05 | 390 | 127.0.0.1 | success | The discovery_id was used to successfully retrieve information for the discovery entry named local |
| 06/08/19 09:05 | 391 | 127.0.0.1 | success | Set discovery entry status to complete |
| 06/08/19 09:05 | 392 | 127.0.0.1 | finish | Completed discovery, scanned 1 IP addresses |