RSA Authentication Manager 8.x hardware appliances and virtual appliances

The RSA Authentication Manager server is a hardened appliance system. It has a standardized environment, firewall and scheduled patches to update the entire Authentication Manager system, including the OS files and libraries the included database). Because of this, installing any additional third-party software or application is not supported.

The RSA Authentication Manager 8.x appliance has some built-in monitoring tools described in Chapter 14 (Logging and Reporting) of the Authentication Manager Administrator's Guide for your version. 

This chapter describes in detail how to activate SNMP monitoring, remote syslog configuration and triggering an email if critical events occur. To enable,

1. Log in  the Security Console
2. Navigate to Setup > System Settings.
3. Select Basic Settings.
4. Configure Critical System Event Notification:

• • Will send emails about events to configured users (an SMTP Mail server has to be already configured for this to work.)
  • Logging will write logs to an the internal database and OS and to a remote Syslog system. Save to internal database and remote syslog at the following hostname or IP address.
  • Select Advanced Settings. Network Monitoring (SNMP), will provide a configuration screen for a SNMP v3 agent and the MIB for Authentication Manager (and will add the necessary rules in the background).

Conclusion

Modifying the Authentication Manager appliance in Linux is not supported, and is not tested, so there is risk in doing so. Therefore, it is expected that installing third party software, or connecting the Authentication Manager appliance to use third party products, especially products that monitor and send feedback or reports to external servers, cannot realistically be supported as there are an endless list of such products.

Context

There is also risk involved in installing unsupported products on the Authentication Manager appliance. In Support we use the term "unsupported" to indicate software or configuration changes that are not part of the Authentication Manager patching procedure. This essentially does not mean it won’t work, it might, but it means RSA does not test that configuration, it could be overwritten by our patches, and if you report a bug that Engineering cannot reproduce your bug on their supported/vetted system, then no fix can be expected.

Having said that, in the experience of Support, some modifications are much less risky than others. One example is using a strong password generator for use with Linux SSH accounts. RSA only supports a single user ID in Linux for console of SSH access; that is the rsaadmin account created during Deployment/Quick Setup. However, many customers have modified Linux to include multiple SSH accounts as a way to track and enforce non-repudiation.

Adding strong passwords to the Linux logon is a simple, very low risk addition to this practice, even though it is unsupported.

Another approach would be to install the MFA Agent for Unix on the Authentication Manager server, to enforce 2FA for SSH logons.