RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.1.x, 8.2.x, 8.3.x
Only failed SSH authentication login attempts are logged in the RSA Authentication Manager /var/log/messages logs. Successful attempts are not logged.
RSA Authentication Manager 8.3 and earlier used older versions of SUSE Linux Enterprise Server as its operating system. The default behavior of older versions of SLES is to log only failed attempts.
To enable logging of successful SSH logins apply the following changes:
- SSH into Authentication Manager.
- Change to root using the following command:
sudo su -
- Edit the file /etc/pam.d/common-session using the following command:
- Press i to enter Insert mode.
- Add the following line to the end of the file:
session required pam_warn.so
- Press ESC to exit Insert mode.
- Save and exit by typing :wq!
- Repeat steps 1 - 7 on each RSA Authentication Manager instance, whether it is a primary or a replica, to log successful SSH authentication attempts for the instance.