pyTenable unable to login to Tenable.SC after update from 5.19 to 5.20

[Cthulhu709]

Describe the bug Since updating to Tenable.SC 5.20, pyTenable is no longer able to login to the .SC host to perform it's queries. It is failing at Authentication, even though the credentials have not changed, and have been verified as valid using the user-login page.

To Reproduce Run the Python integration script

Expected behavior

1. Executing Tenable Remedy Vulnerability Ticketing Integration 2. Successfully Authenticated to Remedy 3. Listing Remedy queries in Tenable.SC 4. Loading mapping category Urgency 5. Listing Remedy queries in Tenable.SC ... < continues on to complete the integration **Problematic output** 1. Executing Tenable Remedy Vulnerability Ticketing Integration 2. Successfully Authenticated to Remedy 3. 'version' 4. Invalid Tenable.sc Instance 5. Traceback (most recent call last): 6. File "/usr/local/lib/python3.6/site-packages/tenable/sc/__init__.py", line 219, in __init__ 7. self.version = self.info['version'] 8. KeyError: 'version' 9. 10. During handling of the above exception, another exception occurred: 11. 12. Traceback (most recent call last): 13. File "./vulnerability_ticketing.py", line 415, in 14. main() 15. File "./vulnerability_ticketing.py", line 25, in main 16. sc = create_authenticated_tenable_session(config["tenable"]) 17. File "/opt/TenablePy/src/securitycenter/lib/Shared.py", line 56, in create_authenticated_tenable_session 18. ssl_verify=tenable_config_section_dict['ssl_verify']) 19. File "/usr/local/lib/python3.6/site-packages/tenable/sc/__init__.py", line 231, in __init__ 20. raise ConnectionError('Invalid Tenable.sc Instance') 21. tenable.errors.ConnectionError: Invalid Tenable.sc Instance **System Information (please complete the following information):** - RH EL 7 - 64 bit - TenableSC 5.20 / pyTenable 1.4.3 - 8G

[6illess]

Are you sure you are on the latest pyTenable version? We had the same issue and it was fixed by updating to the latest version. Which Python version are you using? I notice a reference to 3.6 in your output.

[Cthulhu709]

pyTenable has been updated today to the latest version, 1.4.3.. The errors were generated when it was earlier than that, but I don't recall where we started.

Python package is Python 2.7.5

[6illess]

Please try updating Python to v3.6 or higher.

[Cthulhu709]

Somewhere along the line... the output is shorter now.. so @6illess here's the latest..

TenablePy]# /opt/TenablePy/newcases.sh

Executing Tenable Remedy Vulnerability Ticketing Integration Successfully Authenticated to Remedy /usr/local/lib/python3.6/site-packages/tenable/base/platform.py:171: AuthenticationWarning: Starting an unauthenticated session AuthenticationWarning) Starting an unauthenticated session. Traceback (most recent call last): File "./vulnerability_ticketing.py", line 415, in main() File "./vulnerability_ticketing.py", line 25, in main sc = create_authenticated_tenable_session(config["tenable"]) File "/opt/TenablePy/src/securitycenter/lib/Shared.py", line 58, in create_authenticated_tenable_session passwd=b64decode(tenable_config_section_dict['password']).decode('utf-8')) TypeError: login() got an unexpected keyword argument 'user' Fri Jan 14 17:25:47 MST 2022

[Cthulhu709]

@6illess aren't there fundamental differences changing major Python distro versions?

[6illess]

That’s correct but as stated on https://pytenable.readthedocs.io/en/stable/

pyTenable version 1.2 is the first release to drop support for Python versions less than 3.6. If you are still using any of these deprecated python versions the 1.1 release will still work, however is no longer being actively developed or maintained.

If you’re using custom scripting you might want to review your code.

[Cthulhu709]

Apparently, we're already on 3.6....

[root@host TenablePy]# cd /opt/TenablePy/src/securitycenter/ [root@host securitycenter]# python3 Python 3.6.8 (default, Nov 18 2021, 10:07:16) [GCC 4.8.5 20150623 (Red Hat 4.8.5-44.0.3)] on linux

[root@host TenablePy]# cat ./newcases.sh

!/bin/bash

cd /opt/TenablePy/src/securitycenter python3 ./vulnerability_ticketing.py

[dzinni]

It looks like Tenable.sc 5.20.0 is not providing info.version anymore. You can confirm that by adding something like print(self.info) right before self.version = self.info['version'] in __init__. The dictionary doesn't contain version. I have just added the following lines in __init__ as a quick workaround to get it working again.

            if 'version' in self.info:
                self.version = self.info['version']
            else:
                self.version = '5.20.0'

Hope this helps.

[Cthulhu709]

Thanks for the info.

I've relayed it to our automation team, and tenable. I really think if this function is supported in 5.19, it shouldn't be yanked for a minor update.

We'll see what happens.

Thanks again.

[Cthulhu709]

@dzinni I had a look at the init.py, [git is removing the underscores] and the file is completely empty. I don't see self.info in the .py script that I Run, nor do I see any self in the script. I grepped the folders involved and found the same result...

I've added your recommended code above to the init.py file, and it doesn't seem to work... I'm not proficient in Python, so I'm going to continue pursuing this with our automation team... but wanted to provide an update.

Thanks again.

[damianzinni]

Hi, based on the output you pasted when opening this issue, the file where you would make the change is /usr/local/lib/python3.6/site-packages/tenable/sc/init.py. Is that the one you were looking at?

You would need to replace this line self.info['version'] with the ones I mentioned earlier. Let me know if that works.

[Cthulhu709]

Hi @dzinni

Okay.. I found the other init.py...

def _key_auth(self, access_key, secret_key):

if we can pull a version, check to see that the version is at least

    # 5.13, which is the minimum version of SC that supports API Keys.  If
    # we cant pull a version, then we will assume it's ok.

    #mv - added override to define version for when it's not available
    if 'version' in self.info:
            self.version=self.info['version']
    else:
            self.version='5.20.0''
    #mv end override 

    if (not self.version
        or VersionInfo.parse(self.version).match('>=5.13.0')
    ):
        self._session.headers.update({
            'X-APIKey': f'accessKey={access_key}; secretKey={secret_key}'
        })
        self._auth_mech = 'keys'
    else:
        raise ConnectionError( .....

I've handed this to our automation team members and am waiting for them to get back to me..

I gave it a try, but not being experienced in .py myself, I'm throwing poop at a wall... this was my output

Traceback (most recent call last): File "./vulnerability_ticketing.py", line 12, in from lib.Shared import ( File "/opt/TenablePy/src/securitycenter/lib/Shared.py", line 10, in from tenable.sc import TenableSC File "/usr/local/lib/python3.6/site-packages/tenable/sc/init.py", line 233 if 'version' in self.info: ^ TabError: inconsistent use of tabs and spaces in indentation

[Cthulhu709]

Found the issues..

1. Tenable is not passing the version value back when queried

   Fix provided by damianzinni works to resolve

2. Tenable.Py has changed parameter names

   Fix is to update referenced 'user' to 'username' and 'passwd' to 'password' when calling login.

Thanks for the help and code.. you saved us a lot of time banging our heads against the desk.

[damianzinni]

@Cthulhu709 - You may want to re-open this issue so it gets fixed by the package maintainers. My solution was just a workaround to get it working as soon as possible. Cheers.

[Cthulhu709]

Thanks. I've reopened it.

I'm a git newb so please forgive my transgressions. :)

[damianzinni]

FYI - This issue is fixed in the latest pytenable version:

    @property
    def version(self):
        if not self._version:
            # We will attempt to pull the version number from the system
            # details method.  If we get an APRError response, then we will
            # simply pass through.
            try:
                version = self.system.details().get('version')
            except APIError:
                pass
            else:
                self._version = version
        return self._version

[SteveMcGrath]

This was addressed in #514