RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x
Platform: Red Hat Linux

After a hard shutdown of the RSA Authentication Manager Web Tier server, the Web Tier services fail to start on reboot and the Web Tier appears Offline in the Operations Console.

Observable symptoms:

• Web Tier services do not start after the server is powered back on
• Web Tier status shows as Offline in Authentication Manager Operations Console > Deployment > Web Tier Deployments > Manage Existing
• The Operations Console and Security Console may be unreachable if this is the only Web Tier in the deployment

Where to look — Web Tier server logs:

• /opt/RSASecurity/RSAAuthenticationManagerWebtier/server/logs/AdminServer.log
• /opt/RSASecurity/RSAAuthenticationManagerWebtier/server/logs/AdminServerWrapper.log

Key errors on restart:

System fingerprint encrypted key is missing
Failed to reload password database

The hard shutdown corrupted the Web Tier's systemfields.properties file. The Web Tier bootstrapper service writes to /opt/rsa/am/utils/etc/systemfields.properties approximately every two minutes. If the Web Tier server is shut down abruptly — for example, during a power outage, a forced restart, or a physically unplugged server — and the file is mid-write at that moment, it becomes corrupted. When the server reboots, the Web Tier services attempt to read the file, fail to load it, and do not start.

This commonly occurs in environments where the Web Tier server does not go through a graceful OS shutdown sequence.

ℹ️ NOTE: Full error stack traces from AdminServer.log and AdminServerWrapper.log are available upon request from RSA Support if deeper diagnosis is required.

Choose your resolution path:

Solution 1: Uninstall and Reinstall the Web Tier

ℹ️ NOTE: Use this option if you do not need to preserve the current Web Tier configuration. For file restoration without reinstalling, use Solution 2.

1. Uninstall the Web Tier by following the uninstall procedure in the RSA Authentication Manager Web Tier Installation and Configuration Guide.
2. Reinstall the Web Tier using the same guide.
3. Verify: Log in to the Authentication Manager Operations Console and navigate to Deployment > Web Tier Deployments > Manage Existing. Within approximately 5 minutes, confirm the Web Tier status returns to Online.

Solution 2: Restore the systemfields.properties File

⚠️ CAUTION: This procedure requires SSH access to both the primary Authentication Manager server and the Web Tier server. Complete all steps in order — do not skip steps or reboot between steps until instructed.

1. Connect to the primary Authentication Manager server via SSH as rsaadmin. Enter the OS password when prompted.
2. Navigate to the utils directory:
   

   cd /opt/rsa/am/utils/etc/

3. Confirm the systemfields.properties file is present:
   

   ls -alh systemfields.properties

   Expected output:

   -rw------- 1 rsaadmin rsaadmin 11K Jan 15 16:22 systemfields.properties

4. Copy the file to /tmp for transfer:
   

   cp systemfields.properties /tmp/

5. Use WinSCP or another SCP client to connect to the primary Authentication Manager server as rsaadmin. Download systemfields.properties from /tmp to your local PC, then disconnect.
6. Connect via SSH to the Web Tier server.
7. Elevate to the root user:
   

   sudo su -

   Enter the OS password when prompted.
8. Upload systemfields.properties from your local PC to /tmp on the Web Tier server using WinSCP or another SCP client.
9. Navigate to the Web Tier utils/etc directory:
   

   cd /opt/RSASecurity/RSAAuthenticationManagerWebtier/utils/etc

   ℹ️ NOTE: If your Web Tier was installed to a non-default location, adjust this path accordingly.

10. Rename the corrupted file as a backup:
    

    mv systemfields.properties systemfields.properties.orig

    ⚠️ CAUTION: Do not delete the original file. Renaming it preserves it in case RSA Support needs it for further diagnosis.

11. Copy the file retrieved from the primary Authentication Manager server:
    

    cp /tmp/systemfields.properties ./

12. Check permissions on both files to confirm the correct owner and group:
    

    ls -alh systemfields.properties*

    Expected output:

    -rw-------. 1 root    root    11K Jan 21 08:42 systemfields.properties
    -rw-------. 1 webtier webtier   0 Jan  4 05:36 systemfields.properties.orig

    ℹ️ NOTE: The owner and group of the .orig file reflect the user defined during Web Tier installation (e.g., webtier). Use the values from your .orig file — not the example values shown here.

13. Set the correct permissions on the new file:
    

    chmod 600 systemfields.properties

14. Set the correct owner and group to match the original file (replace webtier:webtier with the owner/group from your environment):
    

    chown webtier:webtier systemfields.properties

15. Switch to the Web Tier install user (replace webtier with the user selected during your Web Tier installation):
    

    sudo su - webtier

16. Navigate to the Web Tier utils directory and identify available versions of the manage-secrets utility:
    

    cd /opt/RSASecurity/RSAAuthenticationManagerWebtier/utils/

    ./rsautil manage-sec

    Expected output:

    Invalid argument. Multiple CLU's starting with 'manage-sec' found:
    manage-secrets-8.1.1.10.0
    manage-secrets-8.1.1.2.0
    manage-secrets-8.1.1.9.0

    ℹ️ NOTE: This error output is expected — it lists the available versions of the utility. Check your Web Tier patch level in the Operations Console and use the matching version in the next step.

17. Run the manage-secrets command matching your Web Tier patch level with the -a recover flag (example shown for Authentication Manager 8.7 SP1 Patch 1):
    

    ./rsautil manage-secrets-8.7.1.1.0 -a recover

    Enter the Operations Console administrator credentials when prompted:

    Please enter OC Administrator username: <OC admin username>
    Please enter OC Administrator password: <OC admin password>

    Expected output:

    Machine fingerprint restored successfully.

18. Start the Web Tier services:
    

    cd /opt/RSASecurity/RSAAuthenticationManagerWebtier/server/

19. Verify: Log in to the Authentication Manager Operations Console and navigate to Deployment > Web Tier Deployments > Manage Existing. Within approximately 5 minutes, confirm the Web Tier status returns to Online. If the status shows Online, the issue has been resolved.