WSUS access denied

[penfold]

I am trying to connect to WSUS with Nessus so I can pull information but I am getting an error in Username/Password. I know the account is good because I can actually log into the server with it. Nessus support basically said nothing to do with us speak to your WSUS Admin (which is me) so I am looking at the IIS logs and I can see a 401 error. I have seen some posts which say that this was resolved by using the IP instead of FQDN but I have tried both with the same issue.

 

Any ideas how to troubleshoot this?

[Michael]

Presumably you're trying to create a parent > child WSUS setup? As you say, normally specifying the FQDN (recommended) or IP should work.

 

I presume you can ping the IP where you are? You may/may not need to create some forward/reverse DNS zones if on a different subnet.

[penfold]

No, I'm not trying to connect WSUS>WSUS together. I am trying to do a scan of WSUS with Nessus. It should scan a client and pull WSUS data for patch status. But if I try and connect to WSUS it gives me the username/pass error. I am seeing some errors in the IIS logs so I'm checking how the authentication is working. I need to look into this next week

[Davit2005]

No experience with this but have you seen this document.

 

 

https://docs.tenable.com/tenablesc/Content/PatchManagement.htm#Windows-Server-Update-Services-(WSUS)

 

Failing that go back to Tenable and say you are the WSUS admin but ask them for any helpful pointers on what credentials should look like/be/example etc.

[penfold]

Yeah, seen that. I also replied to Tenable with the same thing. Their support stops at configuration in Nessus - Only thing to put in is username/pass. I asked what requirements there were but they didn't say. I actually don't think this is a Nessus issues but an authentication in IIS. I will have to look into IIS authentication next week

[Michael]

Just speculating, but is it not domain\username and password if trying to authenticate against IIS?

[penfold]

OK, I am a little lost right now. The account details are configured domain\username. I can log into the server with this account and I can open WSUS and see what is going on so I have confirmed the details are correct.

 

In the security event view I see 2 failures - Credential Validation and Logon.

 

Credential validation just shows The computer attempted to validate the credentials for an account... Error Code: 0xC0000064

Logon shows...Failure Reason: Unknown user name or bad password.

 

IIS logs show 2 errors for the same time POST /ApiRemoting30/webService.asmx ...401 2 5 0 and POST /ApiRemoting30/webService.asmx ...401 1 64 0

 

I am not sure where to start now, account is OK and can authenticate on this servers so is the authentication issue with IIS? I added Windows Authentication using Negotiate to the top as I had read somewhere it could be an issue if NTLM was specified first. But I still have the same issue. Now I'm at the point where I can't see the wood from the trees. It must be something simple, but I just cant see it. Any help would be greatly appreciated.

[penfold]

I've gone through the IIS logs and I can see that the account has the correct permissions a I can see successful login in the log files. However, these are not from the Nessus job. When a Nessus scan is run the entry from the logs do not show the username/pass, but instead show the IP address of the scanner.

 

Logs from IIS logs show

2021-09-16 05:14:06 IPV6 POST /ApiRemoting30/WebService.asmx - 8530 domain\username Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+4.0.30319.42000) - 200 0 0 15

2021-09-16 10:10:31 IPV4 POST /ApiRemoting30/webService.asmx - 8530 - IPAddressofScanner Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0) - 401 2 5 0

 

 

I was wondering why the 2 logs are not using the same connection. Is the difference between the 2 because of using IP4/6? I have checked the application Pools incase that was configured differently and causing the issue, but I can't see anything different.

[penfold]

OK, just to close this in case someone else runs into this...

 

I had confirmation from Tenable that the integration with WSUS is only available up to Server 2012. This feature is no longer supported for later versions. They will be updating their documentation to clearly state this and the only option is to request it as a new feature (which I have done) So for now that is the end for me.

[Davit2005]

OK, just to close this in case someone else runs into this...

 

I had confirmation from Tenable that the integration with WSUS is only available up to Server 2012. This feature is no longer supported for later versions. They will be updating their documentation to clearly state this and the only option is to request it as a new feature (which I have done) So for now that is the end for me.

 

Oh my days. You went through this to get here, I'd seriously be