Article Number
000068145
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: Authentication Agent for PAM
Issue
There is no RSA prompt when switching to root using the su - command. The following error is shown:
PAM unable to dlopen(/usr/lib64/security/pam_securid.so): /usr/lib64/security/pam_securid.so: cannot open shared object file:operation not permitted
PAM adding faulty module: /usr/lib64/security/pam_securid.so
Cause
The configured File Access Policy (fapolicyd) is restricting the loading of the RSA PAM module.
Resolution
Stop the FA Policy service by running the following command:
systemctl stop fapolicyd.service
Workaround
If fapolicyd is a requirement, you must add the RSA libraries to fapolicyd’s trust database on RHEL by running the following commands:
fapolicyd --file add /usr/lib64/security/pam_securid.so --trust-file pam-securid
fapolicyd --file add /var/ace/lib/64bit/libpamrest.so --trust-file pam-securid
fapolicyd --file add /var/ace/lib/64bit/liblog4cxx.so.10 --trust-file pam-securid
fapolicyd-cli --update
systemctl restart fapolicyd
