SSH - Keyboard Interactive Authentication

[KevinA-REJIS]

We have several Dell PowerEdge servers with iDRAC connections. We've previously been able to scan them with SSH credentials, but now we're experiencing a problem.

We recently updated the drivers/firmware on the servers, including iDRAC. Following this, Lansweeper has been unable to scan iDRAC (seems limited to iDRAC8, version 2.70.70.70), saying it cannot connect to SSH with the supplied credentials. After doing some digging, I found in the release notes for that iDRAC version that keyboard interactive authentication has been enabled in its SSH server, requiring both password and keyboard to log in (confirmed when trying to connect with PuTTY).

Is there any way around this?



Link to release notes:

https://topics-cdn.dell.com/pdf/idracv2_70rn_en-us.pdf

[grimstar]

Interesting. Do you happen to use a vulnerability scanner as well? Just curious to know if that is still able to scan successfully.

The fact that you posted this may have saved me a troubleshooting headache somewhere down the line when I inevitably would add our iDRAC credentials and find that it wasn't working.

[KevinA-REJIS]

Esben.D wrote:
Is there no way to turn off this feature?

I'm not sure how there would be a way to work around it other than to try and turn off that functionality at the moment.

What I can do is forward this to the right people so we can take a look at it to see what we can do. So thanks for bringing this up!

I looked through the documentation for that iDRAC firmware level but didn't see anything. I created a topic on Dell's support forums to see if it's possible.

RKCar wrote:
Interesting. Do you happen to use a vulnerability scanner as well? Just curious to know if that is still able to scan successfully.

The fact that you posted this may have saved me a troubleshooting headache somewhere down the line when I inevitably would add our iDRAC credentials and find that it wasn't working.

We do have an AlienVault vulnerability scanner, but it's managed by our LAN/WAN team so I don't know if it's still able to scan.

[Esben_D]

Is there no way to turn off this feature?

I'm not sure how there would be a way to work around it other than to try and turn off that functionality at the moment.

What I can do is forward this to the right people so we can take a look at it to see what we can do. So thanks for bringing this up!