Troubleshoot QID 105053: SSH Authentication Failure on F5 Devices

Problem

SSH authentication fails on an F5 device during a Qualys scan and displays the following error: Data received from target does not match any known pattern -- failing login

As a result, the scan reports QID 105053: Unix Authentication Failed

The authentication log displays messages similar to the following:

+0:00:00 LOGIN: Testing login and finding platform

+0:00:00 LOGIN: SSH banner: 'SSH-2.0-OpenSSH_7.4'

+0:00:00 LOGIN: Initially assuming command environment is 'Unix'

+0:00:00 LOGIN: Login appears to be successful

+0:00:36 LOGIN: Data received from target does not match any known pattern -- failing login

+0:00:36 Login verification failed

Authenticated scans on F5 BIG-IP assets complete without successful login verification. The operating system is not detected correctly during authentication.

Cause

The configured authentication record type does not correctly identify the F5 platform environment.

In some cases:

• The F5 BIG-IP version may not be supported for Unix authentication.
• The target device may use a login environment that is not recognized when the record type is set to Unix.

Solution

Step 1: Verify F5 Version Support

Before troubleshooting authentication, verify that your F5 BIG-IP version is supported in the Authentication Technologies Matrix. If the version is supported, continue with the remediation steps below.

Step 2: Update the Authentication Record

1. In the VM module, go to Scans > Authentication.
2. Locate the Unix authentication record used for the F5 device and click Edit.
3. In the Edit Unix Record dialog box, select the Login Credentials tab.
4. In the Target Type list, change the value from Unix to Auto.
   The Auto option allows Qualys to automatically detect and adapt to non-standard environments such as F5 devices.
5. Verify the configured username and password, and then click Save.
   

Step 3: Launch a New Authenticated Scan

1. In the VM module, go to Scans > Scans.
2. Click New > Scan > Vulnerability Scan.
   Enter a scan title and specify the F5 device IP address or hostname.
3. Select an Option Profile that includes authentication.
   Select the appropriate scanner appliance.
4. Click Launch to start the scan.

Step 4: Verify Authentication Success

1. After the scan completes, go to Scans > Scans.
2. Open the completed scan results and verify whether the authentication is completed successfully, the operating system is detected correctly, and QID 105053 is not available in the scan report

After you update the authentication settings and rerun the scan, Qualys should successfully authenticate to the F5 BIG-IP device and correctly identify the operating system.

If authentication still fails after you change the Target Type to Auto, verify device access settings and SSH configuration on the F5 device.

If the issue persists, contact Qualys Support for further assistance.