shadow1ng/fscan · error

service_auth_failed

service_auth_failed

Error message

service_auth_failed

What it means

Telnet authentication was rejected: the plugin connected, negotiated and sent the credentials, but the server's response indicated login failure. The auth goroutine's else branch emits an ErrorTypeAuth result with the localized 'service_auth_failed' message. It means wrong or refused credentials, not a transport problem.

Source

Thrown at plugins/services/telnet.go:147

			}
			return
		}

		_ = conn.SetDeadline(time.Now().Add(session.Config.ModuleTimeout()))

		if p.performTelnetAuth(conn, cred.Username, cred.Password) {
			resultChan <- &AuthResult{
				Success:   true,
				Conn:      &telnetConnWrapper{conn},
				ErrorType: ErrorTypeUnknown,
				Error:     nil,
			}
		} else {
			_ = conn.Close()
			resultChan <- &AuthResult{
				Success:   false,
				ErrorType: ErrorTypeAuth,
				Error:     fmt.Errorf("%s", i18n.GetText("service_auth_failed")),
			}
		}
	}()

	select {
	case result := <-resultChan:
		return result
	case <-ctx.Done():
		// context 被取消，启动清理协程等待并关闭可能创建的连接
		go func() {
			result := <-resultChan
			if result != nil && result.Conn != nil {
				_ = result.Conn.Close()
			}
		}()
		return &AuthResult{
			Success:   false,
			ErrorType: ErrorTypeNetwork,

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify the credential pair manually (telnet host, log in interactively).
2. Check the target allows telnet login for the attempted account (ACLs, disable rules).
3. Confirm login-prompt detection strings match the device's actual prompts.
4. Rotate/unlock the account if lockout policy triggered.

Example fix

// before
result := plugin.Authenticate(ctx, conn, Credential{Username: "admin", Password: "admin"})
// after
creds := plugins.GenerateCredentials("telnet", cfg) // verified device credentials
for _, c := range creds {
    if r := plugin.Authenticate(ctx, conn, c); r.Success { break }
}

if cred.Username == "" || cred.Password == "" { return errors.New("telnet credential incomplete") }

func credComplete(c Credential) bool { return c.Username != "" && c.Password != "" }

res := plugin.Authenticate(ctx, conn, cred)
if res.ErrorType == ErrorTypeAuth {
    // rejected: move to next credential
}

When it happens

Trigger: Calling Authenticate on the Telnet plugin where the post-login prompt detection shows the session did not reach an authenticated state (login prompt reappeared or an error banner was returned).

Common situations: Weak/incorrect credential lists against real devices; telnet disabled or restricted on the target; login requires specific terminal negotiation the attempt missed; accounts locked by the device.

Related errors

• oracle authentication failed
• oracle advanced authentication negotiation failed
• oracle authentication protocol internal error
• oracle session key should be either 64 or 96 bytes long
• NLA auth failed: error code %d (0x%X)

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/00e36873e982f3eb. Report an issue: GitHub.