Confirmation on Disabling Credential Auditing During Vulnerability Scans

Scanning / scan configuration
1

Hi Everyone,

We are currently using Greenbone Community Edition 26.9 to perform vulnerability scans against our Palo Alto Networks firewall.

During the scan, the firewall generates a large number of authentication failure logs. We observed that the scanner attempts to authenticate using various usernames, such as Administrator, PFCUser, and other common default accounts, resulting in numerous auth-fail events on the firewall.

After reviewing our Scan Configuration, we found that the following NVT families are currently enabled:

  • Brute force attacks

  • Default Accounts

We would like to confirm whether disabling these two NVT families (by unchecking them in the Scan Configuration) is sufficient to prevent OpenVAS from performing any credential auditing, default account testing, or brute-force authentication attempts.

Our objective is to:

  • Continue performing normal vulnerability scanning, including CVE detection, service detection, product detection, and SSL/TLS checks.

  • Completely prevent any username/password auditing or login attempts against the Palo Alto firewall management interface.

If disabling these two NVT families is not sufficient, could you please advise:

  1. Are there any other NVT families that should also be disabled?

  2. Are there any individual NVTs related to authentication or credential testing that should also be disabled?

  3. Are there any Scan Configuration Preferences (such as Disable brute force checks or Disable default account checks) that should also be configured?

  4. recommended configuration to completely disable all credential-related testing while preserving normal vulnerability scanning?

Thank you and appreciate your assistance.

mark

1 Like
2

I guess it depends on what your definition of “username/password auditing”. I guess the short answer to your question is: .

No. Eliminating only those families of VTs does not eliminate all credential auditing.

As an example, The Web application abuses family has some tests for default credentials.

You can see from these filters that there are a few VTs in other families (See the family display chart in the top right-hand corner.

You might think about scan configuration design in a couple ways:

  • Accept-listing the VT families that you want: easy if you have a single type of target that the scan configuration is targeting (i.e. Linux servers, you mentioned Palo Alto firewalls. You can see that almost all VTs that reference Palo Alto are in the Palo-Alto PAN-OS family). You can try using the NVTs page to do some exploration. When cloning a scan config, be sure to use the “Base with a minimum set of NVTs” to include port detection and product detection, etc.

  • Block-listing the VT families that you don’t want: Eliminate what you don’t want. This seems to be the approach you have selected. But, if you take the blocklist approach I would point out that the “General” family has more than credential brute-forcing So, just blindly block-listing these families en-mass is going to also potentially allow other types of exposure. However, you can granularity remove “credential auditing” type VTs if you wish.

3

Dear Support Team,

Thank you very much for your detailed explanation. We really appreciate your assistance .

Based on your recommendation, my understanding is that instead of using a block-list approach (starting from Full and Fast and disabling unwanted VT families), it would be better to use an accept-list approach.

My plan is to create a new Scan Configuration based on “Base with a minimum set of NVTs” (or an empty Scan Configuration), and then enable only the VT families required for our Palo Alto firewall scans, such as:

  Prouct detection
  Service detection
  SSL and TLS
  Web Servers
  Port Scanners
  Palo Alto PAN-OS Local Security Checks" will be temporarily left unchecked   pending further evaluation.

I will leave Brute force attacks, Default Accounts, and other credential-related VT families disabled.

mark

4

One thing to clarify about this:

There is no support team active in this forums. This is a completely user-based forums with some Greenbone internal staff participating on a voluntary basis and irregularly.

A support team is only available for enterprise users.

3 Likes