Configuring site-specific scan credentials

In this topic, you will learn how set up and test credentials for a site, how to restrict them to a specific asset or port, and how to edit and enable the use of previously created credentials.

When configuring scan credentials in a site, you have two options:

• Create a new set of credentials. Credentials created within a site are called site-specific credentials and cannot be used in other sites.
• Enable a set of previously created credentials to be used in the site. This is an option if site-specific credentials have been previously created in your site or if shared credentials have been previously created and then assigned to your site.

To learn about credential types, review Managing shared scan credentials.

Starting configuration for a new set of site-specific credentials

The first action in creating new site-specific scan credentials is naming and describing them. Think of a name and description that will help you recognize at a glance which assets the credentials will be used for. This will be helpful, especially if you have to manage many sets of credentials.

1. Go to the site configuration that you want to add credentials to.
   • To add credentials to a new site configuration, click Create Site on the Home page.
   • To add credentials to an existing site, go to the Sites page and click the Edit icon next to the site.
2. In the site configuration, click the Authentication tab.
3. Click Add Credentials.
4. In the Add Credentials form, enter a name and description for the new set of credentials.
5. Continue with configuring the account, as described in the next section.

Configuring the account for authentication

If you do not know what authentication service to select or what credentials to use for that service, consult your network administrator.

Note: All credentials are protected with RSA encryption and triple DES encryption before they are stored in the database.

1. Click Account under the Add Credentials tab.

2. Select an authentication service or method from the drop-down list.

3. Enter all requested information in the appropriate text fields.

   

4. If you want to test the credentials or restrict them see the following two sections. Otherwise, click Create.

5. To view the newly created credentials, click Manage Authentication and view the Scan Credentials.

Testing the credentials

You can verify that a target asset in your site will authenticate the Scan Engine with the credentials you’ve entered. It is a quick method to ensure that the credentials are correct before you run the scan.

1. In the Add Credentials form, expand the Test Credentials section by clicking the arrow.

2. Expand the Test Credentials section.

3. Enter the name or IP address of the authenticating asset.

   Note: If you do not enter a port number, the Security Console will use the default port for the service. For example, the default port for CIFS is 445.

4. To test authentication on a single port, enter a port number.

5. Click Test credentials.

   Note: If you are testing Secure Shell (SSH) or Secure Shell (SSH) Public Key credentials and you have assigned elevated permissions, both credentials will be tested. Credentials for authentication on the target are tested first, and a message appears if the credentials failed. Permission elevation failures are reported in a separate message. See Using SSH public key authentication.

6. Note the result of the test. If it was not successful, review and change your entries as necessary, and test them again. The Security Console and scan logs contain information about authentication failure when testing or scanning with these credentials. See Working with log files.

   

7. If you want to restrict the credentials to a specific asset or port, see the following section. Otherwise, click Create.

Limiting the credentials to a single asset and port

If a particular set of credentials is only intended for a specific asset and/or port, you can restrict the use of the credentials accordingly. Doing so can prevent scans from running unnecessarily longer due to authentication attempts on assets that don’t recognize the credentials.

If you restrict credentials to a specific asset and/or port, they will not be used on other assets or ports.

Specifying a port allows you to limit your range of scanned ports in certain situations. For example, you may want to scan Web applications using HTTP credentials. To avoid scanning all Web services within a site, you can specify only those assets with a specific port.

1. Click the Account under the Add Credentials tab.
2. Enter only the host name or IP address of the asset that you want to restrict the credentials to. OR Enter host name or IP address of the asset and the number of the port that you want to restrict the credentials to.

   If you do not enter a port number, the Security Console will use the default port for the service. For example, the default port for CIFS is 445.

3. When you have finished configuring the set of credentials, click Create.

   To verify successful scan authentication on a specific asset, search the scan log for that asset. If the message “A set of [service_type] administrative credentials have been verified.” appears with the asset, authentication was successful.

Enabling a previously created set of credentials for use in a site

If a set of credentials is not enabled for a site, the scan will not attempt authentication on target assets with those credentials. Make sure to enable credentials if you want to use them.

1. To enable credentials for an existing site, click that site's Edit icon in the Sites table on the Home page.
2. Click the Authentication link in the Site configuration. The Scan Credentials table lists any site-specific credentials that were created for the site or any shared credentials that were assigned to the site. For more information, see Shared Credentials vs. Site Specific Credentials.
3. Select the Enable check box for any set of credentials that you want to scan with.
4. Click the Save button for the site configuration.

Editing a previously created set of site credentials

The ability to edit credentials can be very useful, especially if passwords change frequently. You can only edit site-specific credentials in a Site Configuration panel.

1. To enable credentials for an existing site, click that site's Edit icon in the Sites table on the Home page.
2. Click the Authentication tab in the Site configuration.
3. Click the hyperlink name of any set of credentials that you want to edit.
4. Change the configuration as desired. See the following topics for more information:

• Starting configuration for a new set of site-specific credentials
• Configuring the account for authentication
• Testing the credentials
• Limiting the credentials to a single asset and port

5. When you have finished editing the credentials, click Save.

Verifying scan credential authentication

1. Upon completion of a scan, on the Scan Overview page, view the Completed Assets table.
2. Locate the asset you have added credentials to.
3. Look at the Authentication column for the located asset.
4. For more information on Understanding Credential Authentication Status, see the next section.
5. For more details, click on the status. The Security Console will bring you to the Node Page.
6. In the asset details, locate Credentials and click on the detail listed.
7. The Security Console will bring you to the Services table.
8. Under the Authentication column, the security console will display which credential was a success or failure.

Enabling scan diagnostics

The scan engine attempts to collect all of the data necessary for a vulnerability or policy assessment, including scan credentials. Even when you submit the proper credentials, vulnerability or policy scans may incorrectly display a partial or total credential failure. Enable Scan Diagnostics to help you better understand what doesn't go as expected and why during credentialed scans. When enabled, Scan Diagnostic checks report a ‘vulnerable’ result against assets when the Scan Engine is supplied with credentials but unable to gather local information.

Scan Diagnostics are disabled by default. To enable Scan Diagnostics, configure Check Categories by adjusting your Scan Templates.

To access the Vulnerability Checks tab in your scan template and enable Scan Diagnostics:

1. In your Security Console, click the Administration tab.
2. In the Scans > Scan Templates section, click Manage.
3. Click the name link of your existing custom scan template to open it. If you don't have a custom scan template yet, click the copy icon next to the built-in scan template of your choice to create one.
4. Scroll down to the Check Configuration section of your scan template. This allows you to adjust vulnerability check options.
5. Select and enable Scan Diagnostics.
6. Save the Scan Template.

Understanding credential authentication status

In the Authentication column, the security console will display one of the following notes to determine the status of your credential authentication:

• Unknown: Credentials did not return a status or you were running a discovery scan.
• Partial Credential Success: Many different types of credentials were used, with one or more service being correct and one or more being incorrect.
• Credential Success: Correct credentials were provided for range of assets.
• Credential Failure: Incorrect credentials were provided for range of assets.
• No Credentials Used: No credentials provided for range of assets.

Using scan diagnostics to find the cause of authentication failure

Scan Diagnostics can give greater visibility to the possible cause of credential authentication failure. Scan Diagnostic checks report vulnerable results for relevant assets when the Scan Engine is supplied with credentials but unable to gather local information.

• Credential Success signifies that the engine was able to authenticate to the device. However, even with working credentials, there are circumstances where aspects of data collection could fail.

• Credential Failure or Partial Credential Success can potentially signify that there has been an issue with authentication. Scan Diagnostics can present greater insight into this situation.