Enable SSH debug logs for RSA Authentication Manager 8.x

[#1]

Article Number

000032238

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: RSA Authentication Manager
RSA Version/Condition: 8.x
 

Issue

When connecting to the Operating System of the RSA SecurID Appliance running RSA Authentication Manager 8.x software an error message is seen.  The example below was taken when using PuTTY as the SSH client:

Server unexpectedly closed network connection

Image description

Task

Debug can be enabled, allowing for an administrator to investigate why this error could be occurring.

1. Logon to the local console as rsaadmin.
2. Change to the root user.
3. Open etc/ssh/sshd_config in a text editor such as vi.

login as: rsaadmin
Using keyboard-interactive authentication.
Password: <enter operating system password>
Last login: Wed Jan  8 13:53:21 2020 from jumphost.vcloud.local
RSA Authentication Manager Installation Directory: /opt/rsa/am
rsaadmin@am82p:~> sudo su - root
rsaadmin's password: <enter operating system password>
am82p:~ # vi /etc/ssh/sshd_config

4. Press i to enter Insert mode.
5. Change the LogLevel value from INFO to VERBOSE (or DEBUG for more information).

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
LogLevel VERBOSE

6. Save the change by pressing Esc then :wq! to save and close.
7. Restart sshd:

am82p:~ # sudo service sshd restart
Shutting down the listening SSH daemon                               done
Checking for missing server keys in /etc/ssh
Starting SSH daemon                                                  done

6. Log data for sshd is written to the /var/log/messages log file

Values that can be used for LogLevel are:  QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3

Resolution

Enabling the SSH debug would be one step in investigating why the server unexpectedly closed the network connection between the server and the SSH client.

Please note that the error message usually occurs due to a network timeout or interruption, so please perform other network related checks between the SSH client and the RSA Authentication Manager instance.