Monitor user login attempts in DX UIM Operator Console (OC)
search cancel

Monitor user login attempts in DX UIM Operator Console (OC)

book

Article ID: 205830

calendar_today

Updated On:

Products

DX Unified Infrastructure Management (Nimsoft / UIM) CA Unified Infrastructure Management On-Premise (Nimsoft / UIM) CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

Our security team would like to monitor user sign-ins to the OC portal. Is there a way to collect audit logs from Operator Console that shows sign-ins with timestamps of Account Users and Bus users and maybe even source IP?

Is it possible to Audit Operator Console login attempts?

Environment

  • Release: 23.4.x
  • Component: Operator Console, wasp

Cause

Guidance

Resolution

■  At a DB level, it is possible to monitor the Last Login Succes time for any user that successfully logs into the OC. 

In the CM_USER table an entry is created each time any user (nimbus user or account user or LDAP user, or LDAP account link users) logs into OC for the first time.

After this when the same user successfully logs in again, it updates the "lastLoginSuccessTime" field in the table. 

Examples:

To audit the Last time a user called '<bususer>' has logged into OC the following query can be used: 

select screenName,firstName,lastName,userType,lastLoginSuccessTime from CM_USER where screenName = '<bususer>' 

 

To audit what is the last user that has logged into OC: 

select TOP 1 screenName,firstName,lastName,userType,lastLoginSuccessTime from CM_USER order by lastLoginSuccessTime DESC

Also, if 'setup/account_lock_enabled' is set to true, via Raw Configure of the OC wasp, then login failure information is kept in as much as there is not a subsequent login success.

select screenName,firstName,lastName,userType,lastLoginSuccessTime,successiveFailedLogins,lastLoginFailureTime from CM_USER

Restrict Incorrect Password Retries in Operator Console/Admin Console

Other keys that are tied to account_lock_enabled set to true:

reset_account_lockout_after
account_lockout_threshold
account_contact.old_password_comparison_count
account_contact.password_expiration_in_days
account_contact.password_expiration_notification.duration_in_days

A possible way of monitoring Logins in the Operator Console is observing the wasp.log and hub.log

Note:  OC wasp loglevel needs to be set to 5 to see log in attempts in wasp.log. Loglevel 3 is sufficient to get information in the hub.log.

(Active monitoring of the activity can be achieved using the logmon probe) 

 

Examples:

 

Administrator (nimbus user) login 23.4.8 wasp.log (Operator Console)

Jul 14 18:21:00:593 DEBUG [http-nio-8080-exec-6, com.firehunter.ump.auth.JWTVerificationFilter] Recieved request from: <ipaddr>
Jul 14 18:21:00:601 DEBUG [http-nio-8080-exec-6, com.firehunter.ump.auth.OCAuth] Login from request usr administrator
Jul 14 18:21:00:601 DEBUG [http-nio-8080-exec-6, com.firehunter.ump.auth.OCAuth] Login from request accountOverride null
Jul 14 18:21:00:601 DEBUG [http-nio-8080-exec-6, com.firehunter.ump.auth.OCAuth] Login from request accountOverride from request null
Jul 14 18:21:00:602 DEBUG [http-nio-8080-exec-6, com.firehunter.ump.auth.OCAuth] Check account override null
Jul 14 18:21:01:116 DEBUG [http-nio-8080-exec-6, com.nimsoft.nimbus.probe.service.wasp.auth.LoginModule] User 'administrator' trying to log in.
Jul 14 18:21:01:138 DEBUG [http-nio-8080-exec-6, com.nimsoft.nimbus.probe.service.wasp.db.DbPreparedStatement] Query uCCqSELECT acl, contact_id, account_id FROM CM_CONTACT WHERE login_name = ? AND password = ?
Jul 14 18:21:01:142 DEBUG [http-nio-8080-exec-6, com.nimsoft.nimbus.probe.service.wasp.db.DbPreparedStatement] Query uCCq took: 0.002s
Jul 14 18:21:01:142 DEBUG [http-nio-8080-exec-6, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] non-contact user found: administrator
Jul 14 18:21:01:157 INFO  [http-nio-8080-exec-6, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] authorizeNimbusUser: user: administrator
Jul 14 18:21:01:344 INFO  [http-nio-8080-exec-6, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] nimbus user authentication successful
Jul 14 18:21:01:353 DEBUG [http-nio-8080-exec-6, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] aclInfo:     Edit Maintenance Mode Schedules=1, ...
Jul 14 18:21:01:358 DEBUG [http-nio-8080-exec-6, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] ACL Superuser permissions [Edit Maintenance Mode Schedules, ...
Jul 14 18:21:01:361 DEBUG [http-nio-8080-exec-6, com.nimsoft.nimbus.probe.service.wasp.auth.LoginModule] administrator logged in.

 

hub.log: 

Jul 14 20:50:49:329 [10460] 3 hub: login [NimBUS] - success for user=administrator ip=<ipaddr>
Jul 14 20:50:49:329 [10460] 1 hub: login - user=administrator permissions=super ip=<ipaddr>
Jul 14 20:50:49:329 [10460] 1 hub: Login: succeeded for administrator, ip = <ipaddr>

 

Contact (account user) login 23.4.8 wasp.log (Operator Console) 

Jul 14 18:30:03:509 DEBUG [http-nio-8080-exec-7, com.firehunter.ump.auth.JWTVerificationFilter] Recieved request from: <ipaddr>
Jul 14 18:30:03:524 DEBUG [http-nio-8080-exec-7, com.firehunter.ump.auth.OCAuth] Login from request usr test_user
Jul 14 18:30:03:524 DEBUG [http-nio-8080-exec-7, com.firehunter.ump.auth.OCAuth] Login from request accountOverride null
Jul 14 18:30:03:524 DEBUG [http-nio-8080-exec-7, com.firehunter.ump.auth.OCAuth] Login from request accountOverride from request null
Jul 14 18:30:03:524 DEBUG [http-nio-8080-exec-7, com.firehunter.ump.auth.OCAuth] Check account override null
Jul 14 18:30:03:540 DEBUG [http-nio-8080-exec-7, com.nimsoft.nimbus.probe.service.wasp.auth.LoginModule] User 'Container1/test_user' trying to log in.
Jul 14 18:30:03:541 DEBUG [http-nio-8080-exec-7, com.nimsoft.nimbus.probe.service.wasp.db.DbPreparedStatement] Query RhNBSELECT acl, contact_id, account_id FROM CM_CONTACT WHERE login_name = ? AND password = ?
Jul 14 18:30:03:548 DEBUG [http-nio-8080-exec-7, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] ACL Operator permissions [Automation - View Items, ...
...
Jul 14 18:30:03:551 DEBUG [http-nio-8080-exec-7, com.nimsoft.nimbus.probe.service.wasp.auth.LoginModule] test_user logged in.


Note: Contact users will not show in the hub.log


LDAP user login 23.4.8 wasp.log (Operator Console) 

Jul 14 21:53:53:949 DEBUG [http-nio-8080-exec-2, com.firehunter.ump.auth.JWTVerificationFilter] Recieved request from: <ipaddr>
Jul 14 21:53:53:961 DEBUG [http-nio-8080-exec-2, com.firehunter.ump.auth.OCAuth] Login from request usr <ldapuser>
Jul 14 21:53:53:961 DEBUG [http-nio-8080-exec-2, com.firehunter.ump.auth.OCAuth] Login from request accountOverride null
Jul 14 21:53:53:961 DEBUG [http-nio-8080-exec-2, com.firehunter.ump.auth.OCAuth] Login from request accountOverride from request null
Jul 14 21:53:53:961 DEBUG [http-nio-8080-exec-2, com.firehunter.ump.auth.OCAuth] Check account override null
Jul 14 21:53:53:975 DEBUG [http-nio-8080-exec-2, com.nimsoft.nimbus.probe.service.wasp.auth.LoginModule] User '<ldapuser>' trying to log in.
Jul 14 21:53:53:977 DEBUG [http-nio-8080-exec-2, com.nimsoft.nimbus.probe.service.wasp.db.DbPreparedStatement] Query VRNBSELECT acl, contact_id, account_id FROM CM_CONTACT WHERE login_name = ? AND password = ?
Jul 14 21:53:53:978 DEBUG [http-nio-8080-exec-2, com.nimsoft.nimbus.probe.service.wasp.db.DbPreparedStatement] Query VRNB took: 0.0s
Jul 14 21:53:53:978 DEBUG [http-nio-8080-exec-2, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] non-contact user found: <ldapuser>
Jul 14 21:53:53:992 INFO  [http-nio-8080-exec-2, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] authorizeNimbusUser: user: <ldapuser>
Jul 14 21:53:54:034 INFO  [http-nio-8080-exec-2, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] Ldap user authentication successful

 

hub.log: 

Jul 14 22:21:07:353 [11756] 2 hub: login [LDAP] - <ldapuser>@<example.com>
Jul 14 22:21:07:354 [11756] 1 hub: access [LDAP] - user=CN=<ldapuser>,<example.com> acl=Operator ldap group=nimsoftadmin perm=3,
Jul 14 22:21:07:354 [11756] 1 hub: login - user=<ldapuser>@<example.com> permissions=admin ip=<ipaddr>
Jul 14 22:21:07:354 [11756] 1 hub: Login: succeeded for <ldapuser>@<example.com>, ip = <ipaddr>

 

Login failure 23.4.8 wasp.log (Operator Console)

Jul 14 18:48:35:176 DEBUG [http-nio-8080-exec-3, com.firehunter.ump.auth.JWTVerificationFilter] Recieved request from: <ipaddr>
Jul 14 18:48:35:179 DEBUG [http-nio-8080-exec-3, com.firehunter.ump.auth.OCAuth] Login from request usr some_user
Jul 14 18:48:35:179 DEBUG [http-nio-8080-exec-3, com.firehunter.ump.auth.OCAuth] Login from request accountOverride null
Jul 14 18:48:35:179 DEBUG [http-nio-8080-exec-3, com.firehunter.ump.auth.OCAuth] Login from request accountOverride from request null
Jul 14 18:48:35:179 DEBUG [http-nio-8080-exec-3, com.firehunter.ump.auth.OCAuth] Check account override null
Jul 14 18:48:35:194 DEBUG [http-nio-8080-exec-3, com.nimsoft.nimbus.probe.service.wasp.auth.LoginModule] User 'some_user' trying to log in.
Jul 14 18:48:35:196 DEBUG [http-nio-8080-exec-3, com.nimsoft.nimbus.probe.service.wasp.db.DbPreparedStatement] Query qqqSSELECT acl, contact_id, account_id FROM CM_CONTACT WHERE login_name = ? AND password = ?
Jul 14 18:48:35:196 DEBUG [http-nio-8080-exec-3, com.nimsoft.nimbus.probe.service.wasp.db.DbPreparedStatement] Query qqqS took: 0.0s
Jul 14 18:48:35:196 DEBUG [http-nio-8080-exec-3, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] non-contact user found: some_user
Jul 14 18:48:35:208 INFO  [http-nio-8080-exec-3, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] authorizeNimbusUser: user: some_user
Jul 14 18:48:35:211 INFO  [http-nio-8080-exec-3, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] nimexception: code: 12, msg: login failed
Jul 14 18:48:35:211 INFO  [http-nio-8080-exec-3, com.nimsoft.nimbus.probe.service.wasp.auth.LoginManager] nimexception: code == E_LOGIN, returning null

 

Login failure 23.4.8 hub.log: 

Jul 14 18:57:15:996 [5984] 0 hub: login [NimBUS] - user does not exist user=some_user ip=<ipaddr>
Jul 14 18:57:15:996 [5984] 0 hub: Login: failed for some_user, ip = <ipaddr>

 

Additional Information

Powered by Wolken Software