000034445 - Unable to login into RSA Identity Governance and Lifecycle with secure HTTPS with time out error

Configure firewall to open and redirect the ports

1. Log on to the appliance from the SSH console as the root user.
2. Make sure iptables is enabled by executing the chkconfig command below.  This command will let you see if the iptables service is set to be on or off, based on runlevels. In the example below, the iptables service is off on all runlevels.

[root@server ~]# chkconfig --list iptables
iptables        0:off   1:off   2:off   3:off   4:off   5:off   6:off

3. If the iptables service is off, we need to turn it on using the chkconfig command below:  In the example here, this will make the changes for runlevels 2, 3, 4 and 5.

[root@server ~]# chkconfig iptables on
iptables       0:off   1:off   2:on    3:on    4:on    5:on    6:off

4. Backup the existing iptables file.
   
   1. Navigate to the directory below:

[root@server ~]# cd /etc/sysconfig/

2. Take a backup of the iptables file, using the -p switch to preserve the specified attributes, such as default: mode, ownership, timestamps):

[root@server sysconfig]# cp -p iptables iptables_bk

5. Open and edit the iptables file with a text editor, such as vi:

[root@server ~]# vi /etc/sysconfig/iptables

6. Add the following lines, as in the example below, to the firewall section in iptables file to open the ports:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8444 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 1555 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 1158 -j ACCEPT
COMMIT

7. Add a network address translation section, if you don’t have one, to perform port redirection from the standard https port. Note:  The NAT section typically appears before the *filter section.  If you already have a *nat section, add the two REDIRECT lines.  In this case, the *nat section is not there so it was added this way with two REDIRECT lines, just above the *filter section.

*nat
:PREROUTING ACCEPT
:POSTROUTING ACCEPT
:OUTPUT ACCEPT
-A PREROUTING -i bond0 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443
-A PREROUTING -i bond0 -p tcp -m tcp --dport 444 -j REDIRECT --to-ports 8444
COMMIT

8. Save the file.  To exit from vi and save changes, press Esc then type :wq! to save and quit vi.
9. Restart iptables with the command below.  Make sure iptables restarts without any error.

[root@server ~]# service iptables restart
iptables: Setting chains to policy ACCEPT: nat             [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules:                         [  OK  ]

10. Verify the rules were applied correctly by listing the iptables rules in the table view with the list command below:

[root@server ~]# iptables -L 
Chain INPUT (policy ACCEPT) 
target prot opt source destination 
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED 
ACCEPT icmp -- anywhere anywhere 
ACCEPT all -- anywhere anywhere 
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh 
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:pcsync-https 
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:pcsync-http 
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:livelan 
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:dbcontrol-oms 
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ftp 
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited 
Chain FORWARD (policy ACCEPT) 
target prot opt source destination 
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited 
Chain OUTPUT (policy ACCEPT) 
target prot opt source destination

11. Verify that the /etc/sysconfig/iptables file looks similar to the following.  Use a cat command to view the file.

[root@server ~]# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*nat
:PREROUTING ACCEPT
:POSTROUTING ACCEPT
:OUTPUT ACCEPT
-A PREROUTING -i bond0 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443
-A PREROUTING -i bond0 -p tcp -m tcp --dport 444 -j REDIRECT --to-ports 8444
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8444 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 1555 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 1158 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

12. Using the following URL:  https://<installation_machine_IP_address>, log on to RSA Identity Governance and Lifecycle from any compatible web browser and verify it is now accessible.  The RSA Identity Governance and Lifecycle login screen will appear.
13. Enter the default credentials:

14. When prompted, change the password for the AveksaAdmin user.
15. Enter your new password in the New Password box.  Re-enter your new password in the Confirm Password box.  Click OK.  Valid passwords must consist of at least eight characters, one upper and one lower case character, and one number.

[root@example.com ~]# cat /etc/sysconfig/iptables
      1 # Firewall configuration written by system-config-firewall
      2 # Manual customization of this file is not recommended.
      3 *filter
      4 :INPUT ACCEPT [0:0]
      5 :FORWARD ACCEPT [0:0]
      6 :OUTPUT ACCEPT [0:0]
      7 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
      8 -A INPUT -p icmp -j ACCEPT
      9 -A INPUT -i lo -j ACCEPT
     10 -A INPUT -j REJECT --reject-with icmp-host-prohibited
     11 -A FORWARD -j REJECT --reject-with icmp-host-prohibited
     12 COMMIT

Unable to login into RSA Identity Governance and Lifecycle with secure HTTPS

Errors

07/13/2012 16:22:11.516 INFO (main)
[org.apache.coyote.http11.Http11Protocol] Starting Coyote HTTP/1.1 on http-
0.0.0.0-8080
07/13/2012 16:22:11.557 ERROR (main)
[org.apache.coyote.http11.Http11Protocol] Error starting endpoint
java.io.IOException: Keystore was tampered with, or password was incorrect
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:771)

Reason

Solution

Unable to login into RSA Identity Governance and Lifecycle with secure HTTPS

Errors

2012-07-17 07:29:50,431 INFO [org.apache.coyote.http11.Http11Protocol]
Initializing Coyote HTTP/1.1 on http-0.0.0.0-8080
2012-07-17 07:29:50,560 ERROR [org.apache.coyote.http11.Http11Protocol]
Error initializing endpoint
java.io.IOException: Cannot recover key
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init
(JSSESocketFactory.java:394)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket
(JSSESocketFactory.java:135)
at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:497)
at org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:176)
at org.apache.catalina.connector.Connector.initialize(Connector.java:1073)
at org.apache.catalina.core.StandardService.initialize
(StandardService.java:668)

Reason

Solution