SSH Connections Through PAM Close Quickly

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

When making an SSH connection through PAM, the window will close almost immediately without an errors. Port 22 is open to the device and the account can be verified, so the password is correct. Nor are there any kex algorithm or cipher errors.

Environment

Privileged Access Manager, all versions

Cause

In this case, there was an issue with the Socket Filter Agent installed on the device.

For a good connection with an SFA, the following will be observed in the SPFD logs.
2024-03-13 13:42:53 3313191 INFO  do_hello: connected to (sshDeviceIP:8550), fipsmode=0
2024-03-13 13:42:53 3313191 INFO  getPublicIp: pam ip for reporting violation [pamIP]
2024-03-13 13:42:53 3313191 INFO  do_rule_set: request: SFA-PDU: version=#,id=#,status=0,reserved=0,ecode=###, 10.10.10.10|22|10.20.30.40|22|...
2024-03-13 13:42:53 3313191 INFO  init: Using SFA connection to sshDeviceIP:22

The SPFD logs had the following for the SFA connection in this issue, but there could be other errors.
2024-03-13 19:43:03 3900888 INFO  do_hello: connected to (sshDeviceIP:8550), fipsmode=0
2024-03-13 19:43:03 3900888 ERROR aes_decrypt: wc_AesCbcDecrypt pad amount 204 > AES_BLOCK_SIZE
2024-03-13 19:43:03 3900888 INFO  init: Success to cleanup SFA.
2024-03-13 19:43:03 3900888 INFO  init: Using SFA connection to sshDeviceIP:22

Resolution

Check /var/log/gksfd.log on the device for any errors with the Socket Filter Agent and correct them.