Error: PAM-CM-3478 While Rotating SSH Keys by Other Account

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

A Unix target account is configured to manage the SSH key of other accounts on the same server, but attempts to update their keys fail with error "PAM-CM-3478: Failed to update the account credentials": 

When an account is configured to rotate its own SSH key, it is successful.

Cause

When another account is used to rotate SSH keys, PAM uses sudo as part of the Linux commands. If the target device is configured to run sudo commands in a pseudo terminal, the commands are being run as a background process in a pseudo terminal. The script processor cannot properly read the output from the terminal and determine if the commands were successful. With Tomcat Log Level set to Info, the following will be observed in the logs.

Feb 04, 2022 10:51:29 PM com.cloakware.cspm.server.plugin.ScriptProcessorImpl debug
INFO: start executing the default UNIX credentials update script
Feb 04, 2022 10:51:29 PM com.cloakware.cspm.server.plugin.CSPMClientChannel write
INFO: T4819 - sent data 'sudo -u sshkeyuser sh -c 'echo "ssh-rsa AAAAB3Nza.....MzyPasDhFl" > ~sshkeyuser/.ssh/id_rsa.pub'
'
Feb 04, 2022 10:51:29 PM com.cloakware.cspm.server.plugin.CSPMClientChannel write
INFO: T4819 - sent data 'echo 1577532725454401456-$?--8836686190026563597
'
Feb 04, 2022 10:51:42 PM com.cloakware.cspm.server.security.UserSecurityContextImpl <init>
INFO: Creating UserSecurityContext, using privilege map: true
Feb 04, 2022 10:51:42 PM com.cloakware.cspm.server.app.impl.ViewAccountPasswordNoWorkflowCmd invoke
INFO: ViewAccountPasswordNoWorkflowCmd.invoke, start
Feb 04, 2022 10:51:42 PM com.cloakware.cspm.server.app.impl.ViewAccountPasswordNoWorkflowCmd invoke
INFO: ViewAccountPasswordNoWorkflowCmd.invoke, end:true
Feb 04, 2022 10:51:42 PM com.cloakware.cspm.server.security.UserSecurityContextImpl <init>
INFO: Creating UserSecurityContext, using privilege map: true
Feb 04, 2022 10:51:45 PM com.cloakware.cspm.server.plugin.CSPMClientChannel readUntil
INFO: T4819 - received data 'Last login: Fri Feb  4 22:50:38 2022 from xxxx.mydomain.net
sudo -u sshkeyuser sh -c 'echo "ssh-rsa AAAAB3Nza.....MzyPasDhFl" > ~sshkeyuser/.ssh/id_rsa.pub'
echo 1577532725454401456-$?--8836686190026563597
[pamadmin@#### ~]$ sudo -u sshkeyuser sh -c 'echo "ssh-rsa AAAAB3Nza.....MzyPasDhFl" > ~sshkeyuser/. ssh/id_rsa.pub'
echo 1577532725454401456-$?--8836686190026563597
[pamadmin@#### ~]$ ' does NOT CONTAIN the case-sensitive string '1577532725454401456-0--8836686190026563597'
Feb 04, 2022 10:51:45 PM com.cloakware.cspm.server.plugin.BeanShellScriptProcessorImpl executeScript
INFO: stopping script processor

Note that the text returned in the "received data" log line is just an echo of the commands sent by PAM and does not contain any output from those commands. PAM expects command "echo 1577532725454401456-$?--8836686190026563597" to return "1577532725454401456-0--8836686190026563597", if the previous command, in this case "sudo -u sshkeyuser ...", was successful, and considers the update attempt a failure since it doesn't find this substring in the returned data. Numbers "1577532725454401456" and "-8836686190026563597" are two random numbers generated on the fly by the UNIX target connector update script. Your log messages will show different random numbers.

Resolution

The pseudo terminal setting is configured in the /etc/sudoers file. On the target device, open sudoers for editing and comment out the use_pty setting as below.

#Defaults use_pty

After updating the sudoers file, attempt to rotate the SSH keys and it will now be successful.