I am having an issue with McAfee VSE for Linux (220.127.116.11698) installed on Red Hat Enterprise Linux 6. The software has been installed with no errors. All services are running properly and I can access the Web Page to make configuration changes. The issue I am having is once I login to the Web Page, I then see to failed logins for the nails user. Here are the exact symptoms:
System has been rebooted.
- I login to the McAfee VSE webpage
- Access is granted; 2 failed logins are recored for the NAILS user.
- I can make any change required or switch to differenet configuration pages; no additional failed logins are recored.
- Log off and close web browser; 1 additional failed login is recored for a total of 3
- Each subsequent login wil recored a failed login unitl eventually the account is locked out by surpassing the failed login attempts.
The nails account is created with no login shell (/sbin/nologin). As a result the LastLog shows nails as having never logged in.
The apache error log located at /var/opt/NAI/LinuxShield/log/apache/error_log shows no errors related to apache mpm_event:notice only.
The audit log, using the aureport -au command show the nails account log success
Using aureport --failed shows 10 failed authentication attempts and 3 failed logins. However, there are 4 failed login attempts for nails.