ssh_enumusers.rb: Change default value of 'CHECK_FALSE' to true (closes #17810)

[samueloph]

The default action "Malformed Packet" reports all users as found even
though they don't exist.

Setting "CHECK_FALSE" to true will make the scanner bail out as it
realizes the target is patched.

Closes: #17810

[sempervictus]

This looks like it adds a failed authentication log entry by default to every scanned target which will effect how brute force detection works (OSSEC/fail2ban/etc) on the defending side.

Maybe we change the default action given that it uses a flaw not commonly present in the protocol?

[bcoles]

This looks like it adds a failed authentication log entry by default to every scanned target which will effect how brute force detection works (OSSEC/fail2ban/etc) on the defending side.

Maybe we change the default action given that it uses a flaw not commonly present in the protocol?

I don't follow. Is your commentary related to the change in this PR? Or are you suggesting changing the default action in addition to the change in this PR?

[sempervictus]

Suggesting we not default to attempting authentication with a nonexistent name as that will create the type of log entry such tools look for in their tailing of the log files/channels.

[bcoles]

Suggesting we not default to attempting authentication with a nonexistent name as that will create the type of log entry such tools look for in their tailing of the log files/channels.

As opposed to the subsequent hundreds (or thousands) of requests?

[sempervictus]

Ah! Gotcha, its not failing to scan its failing to stop scanning; thanks. Pardon, withdrawn 😄.

[space-r7]

Release Notes

This sets the CHECK_FALSE option to true by default so that the auxiliary/scanner/ssh/ssh_enumusers scanner module will bail upon detecting false positive results.