How to reset the system fingerprint -RSA AM
2 years ago
Originally Published: 2014-07-01
Article Number
000060846
Applies To
RSA Authentication Manager (AM) 7.1
RSA SecurID Appliance 3.0
Issue
How to reset the system fingerprint
Cause
On some systems when hardware or some system details like the Hostname are replaced the system fingerprint will need to be reset. The system fingerprint is a security measure that will prevent the system from starting if anything has changed.
Resolution

To reset the fingerprint of the server you will first need to reset it using CLU commands. This is different on the different OS that Authentication Manager can by installed on. This solution has broken it down to Windows, Linux/Unix and Appliance.

In Windows login as the user that installed Authentication Manager.

You will need to open up a command prompt and change directory to [RSA_HOME]\utils

From there run these commands:

 rsautil manage-secrets -a recover
 Enter Master password: <enter Master Password>
 cd ..\radiusoc\utils
 rsautil manage-secrets -a recover
 Enter Master password: <enter Master Password>

In Linux/Unix you will need to open a command window or connect via SSH and change directory to [RSA_HOME]/utils

From this directory run these commands:

 ./rsautil manage-secrets -a recover
 Enter Master password: <enter Master Password>
 cd ../radiusoc/utils
 ./rsautil manage-secrets -a recover
 Enter Master password: <enter Master Password>

On an RSA Appliance 3.0 you will need to connect to the server via SSH. If your server is not configured for SSH there is 2 ways to do it:

If the Operations Console is available, go to Administration->Networking->Configure Connectivity using SSH Check the box entitled "Enable SSH".

If the Operations Console is not available, a keyboard and monitor must be attached to the appliance.
 Log in as 'emcsrv' using the OS password configured during Quick Setup
 sudo su - root
 Enter the OS password when prompted
        ***NOTE***: In the following command ?service? is not a directory, it is the command
  /sbin/service sshd start        // you should see: Starting sshd  [  OK  ]

Once SSH is available login to the Primary server via SSH using the 'emcsrv' account then type in the following commands:

 sudo su rsaadmin
 Password: <enter OS Password>
 cd /usr/local/RSASecurity/RSAAuthenticationManager/utils/
 ./rsautil manage-secrets -a recover
 Enter Master password: <enter Master Password>
 cd ../radiusoc/utils
 ./rsautil manage-secrets -a recover
 Enter Master password: <enter Master Password>

Once the fingerprint is reset start or restart all the RSA services on the Authentication Manager.