This message was deleted.
# citrix-netscalers
Slackbot
12/04/2023, 11:30 AMThis message was deleted.
k
Kari Ruissalo (WyW)
12/04/2023, 11:37 AMAre you using ADM?
m
Marco Hofmann
12/04/2023, 11:39 AMWe make use of ADM service, but without any licenses.
But I just found it in /var/log/ns.log
Copy code
root@ns01# cat /var/log/ns.log | grep -i "AAA LOGIN_FAILED"
Dec 4 12:01:11 <local0.warn> 192.168.1.16 12/04/2023:11:01:11 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656327 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:03:24 <local0.warn> 192.168.1.16 12/04/2023:11:03:24 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656340 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:05:39 <local0.warn> 192.168.1.16 12/04/2023:11:05:39 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656378 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:07:12 <local0.warn> 192.168.1.16 12/04/2023:11:07:12 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656387 0 : User citrixadmin - Client_ip 20.119.53.110 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:07:53 <local0.warn> 192.168.1.16 12/04/2023:11:07:53 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656410 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:10:07 <local0.warn> 192.168.1.16 12/04/2023:11:10:07 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656419 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:12:20 <local0.warn> 192.168.1.16 12/04/2023:11:12:20 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656473 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:14:40 <local0.warn> 192.168.1.16 12/04/2023:11:14:40 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656482 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:16:55 <local0.warn> 192.168.1.16 12/04/2023:11:16:55 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656520 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:19:11 <local0.warn> 192.168.1.16 12/04/2023:11:19:11 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656536 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:19:42 <local0.warn> 192.168.1.16 12/04/2023:11:19:42 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656545 0 : User citrixadmin - Client_ip 20.119.53.110 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:21:28 <local0.warn> 192.168.1.16 12/04/2023:11:21:28 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656554 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:23:44 <local0.warn> 192.168.1.16 12/04/2023:11:23:44 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656606 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:25:57 <local0.warn> 192.168.1.16 12/04/2023:11:25:57 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656615 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:28:09 <local0.warn> 192.168.1.16 12/04/2023:11:28:09 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656624 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:30:24 <local0.warn> 192.168.1.16 12/04/2023:11:30:24 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656633 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:31:41 <local0.warn> 192.168.1.16 12/04/2023:11:31:41 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656642 0 : User citrixadmin - Client_ip 20.119.53.110 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:32:40 <local0.warn> 192.168.1.16 12/04/2023:11:32:40 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656651 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:34:54 <local0.warn> 192.168.1.16 12/04/2023:11:34:54 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656660 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.
Dec 4 12:37:08 <local0.warn> 192.168.1.16 12/04/2023:11:37:08 GMT ns01 0-PPE-0 : default AAA LOGIN_FAILED 656713 0 : User root - Client_ip 5.182.87.69 - Failure_reason "External authentication server denied access" - Browser Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.k
Kari Ruissalo (WyW)
12/04/2023, 11:40 AMyeah... you should see it in the logs as well as in ADM
Kari Ruissalo (WyW)
12/04/2023, 11:41 AMfailed logon generates an SNMP trap which is not a license-required feature
m
Marco Hofmann
12/04/2023, 11:41 AMWhere in the menu is that hidden?
k
Kari Ruissalo (WyW)
12/04/2023, 12:26 PMwouldn't look for this via GUI, rather CLI -> shell
tail -f /var/log/ns.log | grep -i LOGIN_FAILEDm
Marco Hofmann
12/04/2023, 12:46 PMI see, that's similar to what I did, see the first line of the code above.
Thank you very much!
r
Ryan Gallier
12/04/2023, 2:39 PMGermany? 5.182.87.69
Ryan Gallier
12/04/2023, 2:48 PMI normally find these to be some monitoring system. Probably like PRTG doing an SSH check in to look at free disk space. 🙂
m
Marco Hofmann
12/04/2023, 4:12 PMGermany.
Marco Hofmann
12/04/2023, 4:13 PMAt least for now, I don't recognize that IP.
c
c4rm0
12/04/2023, 8:26 PMGateway insight on ADM is really good will show you all the info on the failed authentication such as username used failure reason client IP and country ect
d
dale scriven
12/04/2023, 9:11 PMI wouldn't think that's a monitoring solution, generally those would show as an internal IP, these are external so unless your monitoring solution is set up incorrectly and routing out to the internet and back again, but then you'd likely recognise the IP anyway. Treat that with suspicion and set that up to be dropped by your firewall. If it's monitoring then someone will complain soon enough.
k
Kari Ruissalo (WyW)
12/05/2023, 6:48 AMhttps://www.brightcloud.com/tools/url-ip-lookup.php puts that IP (5.182.87.69) in to Moscow...
m
Marco Hofmann
12/05/2023, 7:30 AM@c4rm0 Gateway Insights is a licensed feature, is it?
c
c4rm0
12/05/2023, 2:20 PMyeah you enable it on a Vserver (NS GW Vserver) and you have to license the Vservers within ADM. With the Citrix cloud ADM service they give you two free Vservers you can license 🙂
👍🏻 1
k
Kari Ruissalo (WyW)
12/05/2023, 4:03 PMBut the log data is for free... except they're dropping syslog from the service in January apparently
c
c4rm0
12/05/2023, 4:53 PMyeah i seen they are dropping syslog 😞 like everything cloud it seems good at first but then the costs go up and up
k
Kari Ruissalo (WyW)
12/06/2023, 12:34 PMI sort of understand it though, ADM was never supposed to be an audit system. I've tried to steer our customers to use a proper SIEM system instead. However, it will be interesting to see how this aligns with the Analytics portfolio. I'm in hopes they'll fill in the blanks with that product.
2 Views