Cannot upload logs to Cloud SWG Hosted Reporting from Edge SWG. Getting "SSH: Permission denied"

Products

• Cloud Reporting for On-Prem
• ProxySG Software - SGOS

Issue/Introduction

It is not possible to integrate on premises Edge SWG with Cloud based Hosted Reporting service.

After setting up the Edge SWG, as per article 388436 - "Integrating Cloud SWG Hosted Reporting with Edge SWG", the SGOS SSH client fails to upload the files to the server.

Edge SWG's EventLog shows a successful authentication thanks to public key but failure on writing the data (and gain access to the "shell"), log example:

• 20xx-01-04 11:12:32+01:00CET  "SSH: kex successful with peer x.x.x.x, port "22""  0 45000C:96  sgos_log.cpp:150
  20xx-01-04 11:12:32+01:00CET  "SSH: Permission denied (publickey,gssapi-keyex,gssapi-with-mic)."  0 45000B:1  sgos_log.cpp:150
  20xx-01-04 11:12:32+01:00CET  "SSH: Authenticated to upload-eu1.threatpulse.com ([x.x.x.x]:22) using "publickey"."  0 45000C:96  sgos_log.cpp:150
  20xx-01-04 11:12:32+01:00CET  "Access Log (hosted_main): Unable to connect to remote server for log uploading"  0 E0008:1  alog_facility_impl.cpp:3053

Environment

Various regions where to store the access logs are available:

• upload-us1.threatpulse.com
• upload-eu2.threatpulse.com
• upload-eu1.threatpulse.com
• upload-apac1.threatpulse.com
• upload-africa1.threatpulse.com
• upload-au1.threatpulse.com
• upload-ca1.threatpulse.com

But the admin, during the Hosted Reporting service initial wizard setup has to chose and set only one. Then the Edge SWG SSH client has to be set to reach out for the specific region server (host), example "upload-us1.threatpulse.com":

• 

Cause

The Edge SCP client set host is not matching the Cloud based Hosted Reporting service initial wizard chosen region

Resolution

Log into the Enterprise portal console, click on "Subscriptions", then on the "Hosted Reporting" in the configured subscriptions tab. In the pop-up panel "Environments" tab check that the configured country for the environment is matching the Edge SWG set host server region (example: country Belgium then the host server has to be "upload-eu1.threatpulse.com").

If the initial wizard chosen zone (US, EMEA, etc.) has to be changed please create a technical case sharing the details. The Cloud SWG DevOps will carry out the change in the Cloud SWG Hosted Reporting backend

Additional Information

A successful access logs file upload has the following Edge SWG EventLog records:

• 20xx-01-04 16:35:40-00:00UTC  "SSH: kex successful with peer x.x.x.x, port "22""  0 45000C:96  sgos_log.cpp:150
  20xx-01-04 16:35:40-00:00UTC  "SSH: Authenticated to upload-us1.threatpulse.com ([x.x.x.x]:22) using "publickey"."  0 45000C:96  sgos_log.cpp:150
  20xx-01-04 16:35:49-00:00UTC  "Access Log (main): Upload completed successfully.  Maximum bandwidth used was 1.00 KB/sec."  0 E0009:96  alog_manager.cpp:1631
  20xx-01-04 16:35:49-00:00UTC  "Access Log (main): Last remote filename: SG_main__800123456789.log.gz size: 710 bytes"  0 E0009:96  alog_manager.cpp:1638