Questions regarding the RADIUS pre-migration to Authentication Manager v. 8.6 script

[Jay_CS]

Three weeks ago the RSA Advisory recommending that customers wait before updating Authentication Manager to ver. 8.6 until a new RADIUS pre-migration script is available.

https://community.rsa.com/t5/securid-product-advisories/securid-recommends-waiting-for-a-radius-pre-migration-script/ta-p/667206

This situation arises because the SBR RADIUS used in AM 8.5 and earlier is being replaced with FreeRADIUS (Free RADIUS) in AM 8.6.  This situation therefore raises several questions:

1. Is there any ETA for this script?

2. Does the script only identify potential RADIUS configuration issues for remediation or will the script perform any modifications to RADIUS data on the AM 8.5 Server?

3. If the script modifies RADIUS data, any assessment of any risk involved in doing these modifications?

4. Does RSA have any recommendations as to when this script should be run, and if it should be run multiple times, e.g. run it once immediately before updating to 8.6 versus running it multiple times because the script identifies RADIUS configuration issues, that could be changed necessitating running the script again?

[JayGuillette]

Updated March 21, 2022.  The initial version of the RADIUS Pre-migration script released Feb. 18, which was 7Kb in size, had a problem where it could find a false flag issue and reported "FAILURE that there was an Error while exporting the trusted root certificate".  This Failure can be ignored.

A new version of the RADIUS pre-migration script, released in March, unfortunately also named v.1.0, is 9Kb in size, and resolves the issue with unable to export Root CA cert.

The pre-migration script will identify problems within the RADIUS database, and not modify anything in the database.  The script can be run multiple times.  RSA internal users can follow this with Jira, AM-45259.  

Unfortunately, the RADIUS pre-migration script has a new name, which is why we could not find it previously.

RSA Authentication Manager 8.6 Pre-Upgrade Check Tool
https://community.securid.com/t5/securid-authentication-manager/rsa-authentication-manager-8-6-pre-upgrade-check-tool/ta-p/673330

[DavidBerner]

Will this be built into the pre check with the next available patch for 8.6 or is this something we have to run prior to upgrading to 8.6?

[JayGuillette]

The premigration script was completed Feb. 18th, and was supposed to be posted somewhere on RSA Link, but it has not been made available yet.

It has instructions and the script.  I removed internal link to first version of pre-migration script from this post

Here's a short demo video

https://sididentity-my.sharepoint.com/personal/dhanraj_j_saliyan_securid_com/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fdhanraj%5Fj%5Fsaliyan%5Fsecurid%5Fcom%2FDocuments%2FAM%2Fradius%5Fmigration%20issue%2Fdemo%2Frad%2Dpre%2Dmig%2Dscript%2Ddemo%2Dv2%...

[JayGuillette]

RSA Authentication Manager 8.6 RSA RADIUS Pre-Migration Script
https://community.securid.com/t5/securid-staged-documents/rsa-authentication-manager-8-6-rsa-radius-pre-migration-script/ta-p/672173

[JayGuillette]

Sorry, the link above only contains the .PDF, not the rsa-am-pre-upgrade-check-1.0.zip with the rsa-am-pre-upgradecheck-1.0.sh and radVdb.so files.

[DavidBerner]

I cannot access any of these links. Is RSA going to send out any kind of announcement on this?

[mlaviolette]

Same here, I dont have access to any of these links. Still nothing available in the AM 8.6 download section on the RSA site about that pre-migration script. 

[DavidBerner]

RSA provided a script last week and I ran into an issue today running it. Found out that a new script was released late last week.  From what I'm told the old script breaks RADIUS. Why is this not being communicated. Very frustrating.

[patoberli]

Patch 2 is now officially released: https://community.securid.com/t5/securid-authentication-manager/rsa-authentication-manager-8-6-patch-2-readme/ta-p/673023?emcs_t=S2h8ZW1haWx8Ym9hcmRfc3Vic2NyaXB0aW9ufEwwSFZPVjFXNjJGOEU3fDY3MzAyMnxTVUJTQ1JJUFRJT05TfGhL

No idea if it's actually fixed.