000038189 - Successful SSH login attempts are not logged in /var/log/messages in Authentication Manager prior to 8.4

Document created by RSA Customer Support Employee on Jan 3, 2020
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000038189
Applies ToRSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager 
RSA Version/Condition: 8.1.x, 8.2.x, 8.3.x
IssueOnly failed SSH authentication login attempts are logged in the RSA Authentication Manager /var/log/messages logs.  Successful attempts are not logged.
CauseRSA Authentication Manager 8.3 and earlier used older versions of SUSE Linux Enterprise Server as its operating system. The default behavior of older versions of SLES is to log only failed attempts.
ResolutionTo enable logging of successful SSH logins apply the following changes:
  1. SSH into Authentication Manager.
  2. Change to root using the following command:

    sudo su -

  3. Edit the file /etc/pam.d/common-session using the following command:

    vim /etc/pam.d/common-session

  4. Press i  to enter Insert mode.
  5. Add the following line to the end of the file:

    session required pam_warn.so

  6. Press ESC to exit Insert mode. 
  7. Save and exit by typing :wq!
  8. Repeat steps 1 - 7 on each RSA Authentication Manager instance, whether it is a primary or a replica, to log successful SSH authentication attempts for the instance.

Attachments

    Outcomes