• The RSA Authentication Agent 8.0.x for PAM is installed on a supported platform.
• The RSA Authentication Agent 8.0.x for PAM is installed with REST protocol as a operation method.

• The RSA Authentication Agent for PAM installed with UDP protocol as an operation method works fine when the challenged user logs into the machine through SSH.
• The challenged user is not prompted for a passcode, but instead is prompted for a password which is not a behavior observed when the agent is installed using the UDP protocol as operation method.
• After enabling the DEBUG for the REST protocol, the /var/ace/log/mfa_rest.log shows the following error:

To resolve this issue, follow the steps below:

1. Using the procedure in knowledge article 000063937 - How to export RSA SecurID Access Authentication Manager or Cloud Authentication Service Root Certificate, extract the RSA Authentication Manager primary server root certificate.
2. Copy the generated certificate to any location on the machine where the RSA Authentication Agent for PAM is installed using a secure copy client such as  WinSCP.
3. Login as the root user to the Linux server on which the PAM agent is installed.
4. Navigate to /var/ace/conf on the Linux server and edit the mfa_api.properties file,  In the example below the certificate is copied to /var/ace:

5. Open a SSH session and try to authenticate with a challenged user.
6. Enter the RSA passcode at the next prompt and verify that the authentication succeeds.
7. After successful authentication with a passcode, the mfa_rest.log located in directory /var/ace/log shows the following message