Why does changing the IP address on a Linux Web Agent break the shared secret registration?

Products

• SITEMINDER

Issue/Introduction

On a Linux based Web Agent server, if the IP address changed, handshake errors will appear in the SMPS log and the Web Agent will fail to startup.

Ex:

[CServer.cpp:1959][ERROR][sm-Tunnel-00050] Handshake error: Shared secret incorrect for this client

Environment

Web Agents on Linux OS

12.52 and 12.8 Linux Web Agents

Cause

On the Web Agent the shared secret is stored in encrypted form in the SmHost.conf file and decrypted each time it is used. The encryption is derived in part by using the gethostid() function along with other data.

This can be tested by running a few simple commands.

1) # hostname -I 

This is a capital i' and it will return the IP addresses used by the Web Server.

2) # hostid

This will return the hostid value derived from the IP address.

Ex. 

 

This server has 2 local IPs, but the first one happens to be the primary.

3) Taking the hostid value, fc0a199f, which is a hexadecimal value, modify it into octets like an IP address.

fc 0a 19 9f

4) Convert each hexadecimal value into decimal using a programming calculator or a conversion website.

FC → 252
0A → 10
19 → 25
9F → 159

5) The final converted sequence is 252.10.25.159, which is the right octets but not in the same order.

 252.10.25.159 vs 10.252.159.25 

 

This is expected and can still be used to determine if the IP address changed and therefore the hostid changed rendering the value in the SmHost.conf incorrect. This would mean running the hostid command pre-emptively and saving the value for future comparison.

 

Resolution

If the hostid has changed, then either the IP change needs to be reversed or a re-registration of the Web Agent needs to happen so that the new shared secret can be encrypted with the new hostid value.