2 Replies Latest reply: Mar 2, 2015 1:42 PM by yej RSS

    nails user failed logins

    morriel73

      I am having an issue with McAfee VSE for Linux (1.7.1.28698) installed on Red Hat Enterprise Linux 6.  The software has been installed with no errors. All services are running properly and I can access the Web Page to make configuration changes.  The issue I am having is once I login to the Web Page, I then see to failed logins for the nails user.  Here are the exact symptoms:

       

      System has been rebooted.

           - I login to the McAfee VSE webpage

           - Access is granted; 2 failed logins are recored for the NAILS user.

           - I can make any change required or switch to differenet configuration pages; no additional failed logins are recored.

           - Log off and close web browser; 1 additional failed login is recored for a total of 3

           - Each subsequent login wil recored a failed login unitl eventually the account is locked out by surpassing the failed login attempts.

       

      The nails account is created with no login shell (/sbin/nologin). As a result the LastLog shows nails as having never logged in.

       

      The apache error log located at /var/opt/NAI/LinuxShield/log/apache/error_log shows no errors related to apache mpm_event:notice only.

       

      The audit log, using the aureport -au command show the nails account log success

       

      Using aureport --failed shows 10 failed authentication attempts and 3 failed logins. However, there are 4 failed login attempts for nails.