JeffBerry (Customer) asked a question.

July 10, 2026 at 7:21 PM
Server 2008 RSA Authentication stopped working after last AM Update - anyone else run into this?

We run RSA AM internally (no cloud integration) and have MFA Agent (2.4 at the moment) installed on most of our servers. The vast majority are 2016 or newer but we still have a few 2008 R2 servers around unfortunately. I know it's old/unsupported/etc but, but RSA auth has been working fine on these servers until the latest patch (8.9 patch 2) which seemed to break authentication on the 2008 R2 servers. The 2016 servers still work with no issue, but the 2008 servers now just prompt for the reserve password.

 

Anyone run into this or have any suggestions? I checked the logs and all it really says is ServerConnectionFailed. I can ping the RSA AM server fine, and like I said things are working fine on the newer servers.

  • 2 answers
  • 74 views

  • EricaChalfin (RSA)

    @JeffBerry (Customer)​ ,

     

    RSA MFA Agent 2.4 is not supported on Windows 2008 R2 servers. Please see the RSA MFA Agent for Windows Platform Support Matrix for additional details, including links to the MFA Agent 2.4 for Microsoft Windows Installation and Administration Guide that lists the supported OS for that agent.

     

    The recommendation would be to install your agents on a supported operating system so that they continue protecting your environment.

    Expand Post
    Selected as Best

  • EricaChalfin (RSA)

    @JeffBerry (Customer)​ ,

     

    RSA MFA Agent 2.4 is not supported on Windows 2008 R2 servers. Please see the RSA MFA Agent for Windows Platform Support Matrix for additional details, including links to the MFA Agent 2.4 for Microsoft Windows Installation and Administration Guide that lists the supported OS for that agent.

     

    The recommendation would be to install your agents on a supported operating system so that they continue protecting your environment.

    Expand Post
    Selected as Best

  • jay.guillette (RSA SecurID)

    Do you have any details on why the MFA 2.4 fails on Win2008 R2 after the AM server update? If it was working, that indicates that MFA 2.4 sent the Authentication request. If MFA agent sent it, that could indicate that the AM servers rejected the authentication request. If there is nothing in the AM Real Time Monitor, that could indicate that the AM server rejection was at the TLS or network level, likely due to Win2008 R2 using a Cipher that is no longer supported in the updated AM 8.9 server. A network packet capture from WireShark of tcpdump should show the TCP 3-way Synch and the TLS negotiation from the MFA 2.4 Win2008 agent to AM.

    Maybe you could modify the ciphersuites to allow this to work - assuming the risk if modifying the system in this way breaks anything else.

     

    https://community.rsa.com/s/article/Using-tcpdump-to-troubleshoot-authentication-issues-with-RSA-Authentication-Manager-8-x

    shows how to run a tcpdump on an AM server, filter on TCP port 5555 for MFA ReST traffic.

     

    Beginning with Authentication Manager 8.8, TLS cipher suites are no longer controlled by /opt/rsa/am/server/config/config.xml, but in /opt/rsa/am/appserver/jdk/jre/lib/security/java.security. Depending on what we see in the tcpdump, there are some 'unsupported' ways to enable weaker ciphers on AM for specific cases such as this. What I am saying is that Erica gave the correct answer, Windows Server 2008 R2 is not supported for MFA, but there are ways, aka hacks, that if done carefully, with full knowledge that there is risk, Support will advise you on. The internal KBs on how to do this all contain the words, "Use at your own risk" Open a support case to ask more detailed questions.

    Expand Post

Don't see what you're looking for?