cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
878
Views
0
Helpful
3
Replies

Failed Login attemts from IMP Server with user admin

optadata
Level 1
Level 1

RTMT reports several failed login attempts to the CUCM Publisher from both IM&P servers.

LoginFrom : [IM&P IPs]

Interface : Apache-Axis2

UserID : admin

AppID : Cisco Tomcat

ClusterID : 

NodeID : [Publisher IP]

 

Password for admin is the same on Publisher and IM&P (web & CLI).

Failed Jabber and Web logins are logged with the client IPs.

 

Any idea which service might cause this login attempts?

3 Replies 3

Adam Pawlowski
VIP Alumni
VIP Alumni
Maybe AXL?

Maybe, but wouldn't have axl it's own account? Setup on the publisher with credentials set on the Publisher?

What would use the admin account to contact Apache-Axis2 interface on the Publisher infrequently but several times a day, locking the admin account sometimes?

optadata,

 

This might be worth a look.

 

https://tools.cisco.com/security/center/viewAlert.x?alertId=35357

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: