Logon Fails SMB authentication

General support questions for the Secutor Prime product.
Johnbii
Posts: 4
Joined: Thu May 19, 2011 8:27 am

Logon Fails SMB authentication

Postby Johnbii » Thu Jun 16, 2011 9:57 am

When connecting to remote target logon fails immediately. Have to click on X to close out. This even works on hosts that were previously scanned. User name has a underscore which does not appear when typed. Currently using Version 4 build 4003. Can ping and RDP to the host and logon with username and password.

gunnar
Site Admin
Posts: 81
Joined: Fri Feb 23, 2007 8:08 pm
Contact:

Postby gunnar » Thu Jun 16, 2011 11:30 am

The underscore character is actually there, it just gets cropped at the bottom of the text box and is not visible. It's safe to ignore that as a possible cause.

RDP uses a different port than is used for remote assessments. It's a good test to show that the account/password you are using do in fact authenticate, but there are a number of other factors specific to being able to remotely gather the type of information needed.

I would pick one of the machines that you know you used to do remote assessments against and verify that all the settings on that machine are still correct for remote assessments. For the full list of settings refer to the Secutor Prime Help or this forum post:

http://forums.threatguard.com/viewtopic.php?t=20

There are also other factors that can cause remote connection failure. Being able to access one of the SMB ports is one, or differing LANMAN compatibility levels. Both of these can be quickly verified by mounting an administrative share from the remote machine.

Also be sure that you are only using "SMB (Windows)" as the remote connection type.

Johnbii
Posts: 4
Joined: Thu May 19, 2011 8:27 am

Postby Johnbii » Fri Jun 17, 2011 9:26 am

thanks for the speedy reply. What ports do I need to use?

gunnar
Site Admin
Posts: 81
Joined: Fri Feb 23, 2007 8:08 pm
Contact:

Postby gunnar » Fri Jun 17, 2011 9:36 am

For purposes of Windows Firewall exceptions the predefined exception "File and Printer Sharing" covers it.

For purposes of other intervening firewalls the preferred SMB port is TCP 445.

Secutor Prime does a remote probe and only the services that are open will show up as green on the logon screen, so if "SMB (Windows)" is green and lets you select that as the connection type then you're not having a firewall problem.

That being the case, verify the settings as identified in this post:

http://forums.threatguard.com/viewtopic.php?t=20


Return to “Secutor Prime Support”

Who is online

Users browsing this forum: Google [Bot] and 4 guests