RSA Authentication Manager Services Fail to Start Due to 'no pg_hba.conf entry for host' Error
Last Modified: 2024-02-20
Article Number
000072002
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
Issue
  • Several Authentication Manager services are encountering startup failures, as indicated by the errors logged in the postgres logs located at /opt/rsa/am/rsapgdata/log:
rsa_dba 65cabf13.139b 5/958 0 FATAL:  no pg_hba.conf entry for host "192.168.6.10", user "rsa_dba", database "db", SSL encryption

 

  • Additionally, the errors logged in the /opt/rsa/am/server/logs/radiusoc.log are as follows:
####<Feb 11, 2024 7:17:11,458 PM CET> <Error> <Deployer> <rsa-replica> <radiusoc> <[STANDBY] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <338f01b3-dcd8-4bf0-8100-1d9039ccb5b6-00000008> <1707675431458> <[severity-value: 8] [rid: 0] > <BEA-149231> <Unable to set the activation state to true for the application "am-radius-app".
weblogic.application.ModuleException: org.postgresql.util.PSQLException: FATAL: no pg_hba.conf entry for host "192.168.6.10", user "rsa_user", database "db", SSL encryption
 
  • When starting all the AM services at once (with dependencies) using the below command: 
/opt/rsa/am/server/rsaserv start all
Result:
- Running services:
Database, Administration with OC, Runtime
- Shutdown services:
RADIUS with OC, RADIUS, Console, Replication

 
Cause
Manual editing or modification of the following files on the Authentication Manager server is strictly prohibited:
  • /opt/rsa/am/rsapgdata/pg_hba.conf
  • /opt/rsa/am/rsapgdata/postgresql.conf
Resolution
Follow the steps below to manually copy the file located at /opt/rsa/am/rsapgdata/pg_hba.conf from a functioning AM server and replace the corresponding file on the non-functioning AM server: 

1. Stop all the services on the non-working server:  
/opt/rsa/am/server/rsaserv stop all

2. Use an SSH client (e.g. WinSCP) to connect to the working server. 

3. Copy the /opt/rsa/am/rsapgdata/pg_hba.conf to a Windows machine. 

4. Use an SSH client (e.g. Putty) to connect to the non-working AM server's CLI. 

5. Using WinSCP, copy the pg_hba.conf file (from step #3) from your Windows machine to the /tmp directory on the non-working AM server. 

6. Change directories:  
cd /opt/rsa/am/rsapgdata/

7. Rename the old pg_hba.conf file to pg_hba.conf.bak:  
mv pg_hba.conf pg_hba.conf.bak

8. Copy the pg_hba.conf from the /tmp directory to /opt/rsa/am/rsapgdata/:  
mv /tmp/pg_hba.conf /opt/rsa/am/rsapgdata/

9. Start the AM services:  
/opt/rsa/am/server/rsaserv start all

 

Related Articles

Trending Articles

Don't see what you're looking for?