{"record":{"id":"00e36873e982f3eb","repo":"shadow1ng/fscan","slug":"service-auth-failed-00e368","errorCode":"service_auth_failed","errorMessage":"service_auth_failed","messagePattern":"service_auth_failed","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/telnet.go","lineNumber":147,"sourceCode":"\t\t\t}\n\t\t\treturn\n\t\t}\n\n\t\t_ = conn.SetDeadline(time.Now().Add(session.Config.ModuleTimeout()))\n\n\t\tif p.performTelnetAuth(conn, cred.Username, cred.Password) {\n\t\t\tresultChan <- &AuthResult{\n\t\t\t\tSuccess:   true,\n\t\t\t\tConn:      &telnetConnWrapper{conn},\n\t\t\t\tErrorType: ErrorTypeUnknown,\n\t\t\t\tError:     nil,\n\t\t\t}\n\t\t} else {\n\t\t\t_ = conn.Close()\n\t\t\tresultChan <- &AuthResult{\n\t\t\t\tSuccess:   false,\n\t\t\t\tErrorType: ErrorTypeAuth,\n\t\t\t\tError:     fmt.Errorf(\"%s\", i18n.GetText(\"service_auth_failed\")),\n\t\t\t}\n\t\t}\n\t}()\n\n\tselect {\n\tcase result := <-resultChan:\n\t\treturn result\n\tcase <-ctx.Done():\n\t\t// context 被取消，启动清理协程等待并关闭可能创建的连接\n\t\tgo func() {\n\t\t\tresult := <-resultChan\n\t\t\tif result != nil && result.Conn != nil {\n\t\t\t\t_ = result.Conn.Close()\n\t\t\t}\n\t\t}()\n\t\treturn &AuthResult{\n\t\t\tSuccess:   false,\n\t\t\tErrorType: ErrorTypeNetwork,","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/telnet.go#L129-L165","documentation":"Telnet authentication was rejected: the plugin connected, negotiated and sent the credentials, but the server's response indicated login failure. The auth goroutine's else branch emits an ErrorTypeAuth result with the localized 'service_auth_failed' message. It means wrong or refused credentials, not a transport problem.","triggerScenarios":"Calling Authenticate on the Telnet plugin where the post-login prompt detection shows the session did not reach an authenticated state (login prompt reappeared or an error banner was returned).","commonSituations":"Weak/incorrect credential lists against real devices; telnet disabled or restricted on the target; login requires specific terminal negotiation the attempt missed; accounts locked by the device.","solutions":["Verify the credential pair manually (telnet host, log in interactively).","Check the target allows telnet login for the attempted account (ACLs, disable rules).","Confirm login-prompt detection strings match the device's actual prompts.","Rotate/unlock the account if lockout policy triggered."],"exampleFix":"// before\nresult := plugin.Authenticate(ctx, conn, Credential{Username: \"admin\", Password: \"admin\"})\n// after\ncreds := plugins.GenerateCredentials(\"telnet\", cfg) // verified device credentials\nfor _, c := range creds {\n    if r := plugin.Authenticate(ctx, conn, c); r.Success { break }\n}","handlingStrategy":"retry","validationCode":"if cred.Username == \"\" || cred.Password == \"\" { return errors.New(\"telnet credential incomplete\") }","typeGuard":"func credComplete(c Credential) bool { return c.Username != \"\" && c.Password != \"\" }","tryCatchPattern":"res := plugin.Authenticate(ctx, conn, cred)\nif res.ErrorType == ErrorTypeAuth {\n    // rejected: move to next credential\n}","preventionTips":["Verify credentials interactively on a sample device","Match prompt-detection strings to the actual device OS","Avoid hammering devices with lockout policies","Confirm telnet service is enabled on the target"],"tags":["telnet","authentication"],"backgroundTag":"authentication-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}