Any way to automatically register a RHEL PAMAgent?

[FSP_ICT-IPT]

OS: RHEL 7.5

PAM Agent: 8.5.0

Authentication Protocol: UDP

Is there any way to have Red Hat Linux VDI Clones self register via the PAM Agent automatically as Windows Agents can in RSA Security Console; as per https://community.rsa.com/docs/DOC-77203 

Regards

Garry

[SrirangaPrasan1 · Accepted solution]

This as of now a product limitation for PAM agents. The agent auto registration feature is only for Windows agents for now. 

[JayGuillette]

There is an Ideas Page submitted request for this feature

https://community.rsa.com/ideas/1400?commentID=36081#comment-36081 

Which you could vote on.  

Another approach would be configuring your PAM agent to authenticate with ReST instead of UDP.  The ReST agents can be logical, in other words you create one entry in the Security Console with a name but no IP address, and you configure your PAM agents to use that same logical name in their ReST configuration file.

[RandyBelbin]

We strongly recommend moving to the REST protocol which would eliminate the need for registration of any kind. The end result is the same but without all of the overhead of the auto-registration process.

Now that we are moving all of our agents to the REST protocol, it's unlikely that we would invest in the auto-registration feature for the Linux agent. Rather, we would encourage our customers to take advantage of the new functionality in the REST agent.

[DavidMoreno1]

Can I use the REST protocol to auto register Linux clients? Like EMR or Hadoop node?

[JayGuillette]

Auto-Registration began as a Windows UDP agent concept so as you would not need to manually enter, then change the possibly changing DHCP address of the agent.  You have some options to kind of go around the fact that there is no auto-registration for PAM agents, but the only direct answer is that there is currently no auto-registration for PAM agents.

 1. There is an RFE, Request for Enhancement for this - RSA Authentication Agent for PAM support for AutoRegistration  - which you can vote on

 2. If the Linux servers or workstations have fixed IP addresses, you could bulk create them through AMBA with AAH command.

 3. PAM 8.x agents can be configured in more than one way, so instead of using the legacy UDP protocol for Authentication, you could configure the PAM agent to use the ReST TCP-based protocol for Authentication, and you can configure a Logical agent name instead of using the PAM agent's hostname, DNS short name or FQDN. You could do this on 100s or 1000s of PAM agents, all of which could use the same Logical Agent Name uses a single Agent host entry on the AM security Console - so you avoid the need for auto-registration.

[DavidMoreno1]

Jay,

Can you please elaborate on the item below?

PAM 8.x agents can be configured in more than one way, so instead of using the legacy UDP protocol for Authentication, you could configure the PAM agent to use the ReST TCP-based protocol for Authentication, and you can configure a Logical agent name instead of using the PAM agent's hostname, DNS short name or FQDN. You could do this on 100s or 1000s of PAM agents, all of which could use the same Logical Agent Name uses a single Agent host entry on the AM security Console - so you avoid the need for auto-registration

With this solution am I going to have to convert my current UDP authentication environment to REST authentication or can I run both in parallel?

David.

[JayGuillette]

ReST agents are newer, you need to enable ReST on the Primary and on the Replicas, but the Primary and Replicas can support both UDP legacy agents and the newer ReST API agents.

[SeanDoyle]

You don't need it.. use the REST mode of the modern agents and use a single agent instance in the configuration and you can deploy without registering client IPs. 

[StaceyWatt]

In regards to the below:

PAM 8.x agents can be configured in more than one way, so instead of using the legacy UDP protocol for Authentication, you could configure the PAM agent to use the ReST TCP-based protocol for Authentication, and you can configure a Logical agent name instead of using the PAM agent's hostname, DNS short name or FQDN. You could do this on 100s or 1000s of PAM agents, all of which could use the same Logical Agent Name uses a single Agent host entry on the AM security Console - so you avoid the need for auto-registration.

When you mention:

same Logical Agent Name uses a single Agent host entry on the AM security Console

does that mean in the AM security console you create a new entry of the logical name as the hostname and leave the rest blank?
is there anything else required after you create the host in the AM security console and turned on the authenticate API?