shadow1ng/fscan · error

authentication required

Error message

authentication required

What it means

The Cassandra server responded with an AUTHENTICATE frame (cqlOpAuthChl), meaning credentials are required, but the candidate credential had an empty username and empty password. doCassandraAuth stops with 'authentication required' and ErrorTypeAuth.

Source

Thrown at plugins/services/cassandra.go:126

	// Step 2: 读取响应
	opcode, body, err := cqlRecv(conn)
	if err != nil {
		state.IncrementTCPFailedPacketCount()
		return &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}
	}

	// READY → 已就绪，发送测试查询
	// AUTHENTICATE → 需要认证
	// ERROR → 错误
	if opcode == cqlOpError {
		return &AuthResult{Success: false, ErrorType: ErrorTypeAuth, Error: fmt.Errorf("cassandra error: %s", string(body))}
	}

	// Step 3: 如果需要认证
	if opcode == cqlOpAuthChl {
		if cred.Username == "" && cred.Password == "" {
			return &AuthResult{Success: false, ErrorType: ErrorTypeAuth, Error: fmt.Errorf("authentication required")}
		}
		// SASL PLAIN: \x00username\x00password
		saslToken := []byte("\x00" + cred.Username + "\x00" + cred.Password)
		if err := cqlSend(conn, cqlOpAuthRsp, saslToken); err != nil {
			state.IncrementTCPFailedPacketCount()
			return &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}
		}
		opcode, body, err = cqlRecv(conn)
		if err != nil {
			state.IncrementTCPFailedPacketCount()
			return &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}
		}
		// AUTH_SUCCESS → 认证成功
		// ERROR → 认证失败
		if opcode == cqlOpError {
			return &AuthResult{Success: false, ErrorType: ErrorTypeAuth, Error: fmt.Errorf("authentication failed: %s", string(body))}
		}
		if opcode != cqlOpAuthOk && opcode != cqlOpReady {

View on GitHub (pinned to 95cc12e753)

Solutions

1. Provide valid username/password credentials (default cassandra/cassandra on unmodified installs) so the SASL PLAIN exchange can run.
2. Remove empty credential entries from the credential set if anonymous access is not intended.
3. If the cluster truly allows anonymous access, set authenticator to AllowAllAuthenticator in cassandra.yaml — otherwise this error is expected for blank creds.

Example fix

// before
cred := Credential{Username: "", Password: ""}
// after
cred := Credential{Username: "cassandra", Password: "cassandra"}

if cred.Username == "" && cred.Password == "" {
    // server requires auth; skip blank-cred attempt
    return
}

res := doCassandraAuth(conn, cred, state)
if !res.Success && res.ErrorType == ErrorTypeAuth && res.Error.Error() == "authentication required" {
    log.Printf("%s requires credentials; retest with valid creds", target)
}

When it happens

Trigger: doCassandraAuth receives opcode cqlOpAuthChl after STARTUP while cred.Username == "" && cred.Password == "", i.e. an anonymous/no-auth attempt against a server that demands auth.

Common situations: Testing a cluster with authenticator: PasswordAuthenticator (or CassandraAuthenticator) using blank credentials; credential list accidentally contains an empty entry; assuming AllowAllAuthenticator when the server requires login.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• authentication failed: %s
• SASL authenticate error: %d
• NLA auth failed: error code %d (0x%X)
• %s
• SASL handshake error: %d

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/5f25b2e06fee5acb. Report an issue: GitHub.