cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Community Helping Community

269
Views
0
Helpful
3
Replies
Beginner

Failed Login attemts from IMP Server with user admin

RTMT reports several failed login attempts to the CUCM Publisher from both IM&P servers.

LoginFrom : [IM&P IPs]

Interface : Apache-Axis2

UserID : admin

AppID : Cisco Tomcat

ClusterID : 

NodeID : [Publisher IP]

 

Password for admin is the same on Publisher and IM&P (web & CLI).

Failed Jabber and Web logins are logged with the client IPs.

 

Any idea which service might cause this login attempts?

3 REPLIES 3
Rising star

Re: Failed Login attemts from IMP Server with user admin

Maybe AXL?
Beginner

Re: Failed Login attemts from IMP Server with user admin

Maybe, but wouldn't have axl it's own account? Setup on the publisher with credentials set on the Publisher?

What would use the admin account to contact Apache-Axis2 interface on the Publisher infrequently but several times a day, locking the admin account sometimes?

Participant

Re: Failed Login attemts from IMP Server with user admin

optadata,

 

This might be worth a look.

 

https://tools.cisco.com/security/center/viewAlert.x?alertId=35357

 

CreatePlease to create content
Content for Community-Ad
FusionCharts will render here