How to reset the default factory key when SSH is not authorized

Technical Articles ID: KB74464
Last Modified: 10/18/2021

Environment

McAfee SIEM Enterprise Security Manager (ESM) 11.x.x
McAfee SIEM Advanced Correlation Engine (ACE) 11.x.x
McAfee SIEM Event Receiver (Receiver) 11.x.x
McAfee SIEM Enterprise Log Manager (ELM) 11.x.x
McAfee SIEM Database Event Monitor (DEM) 11.x.x

For environment information, see KB82516 - Supported platforms for Enterprise Security Manager.

Problem

When you try to key a device that was previously keyed, the process fails and you are unable to rekey the appliance.

Cause

This issue can occur when the factory RSA key has been overwritten after a device was previously keyed. All McAfee SIEM equipment ships with a default RSA key that the ESM can use to key the devices. If a unit was previously keyed, the factory key no longer works to rekey the device.

Solution

Use the following steps to reset the default factory key when SSH is not authorized:

Log on to the device using a Secure Shell (SSH) client such as putty.

NOTE: If you log on directly, use a logon of root. The password is the previously keyed password. If you do not have the password, boot the system with a rescue CD to perform the following steps. Follow the steps in KB81840 - How to use a USB drive as a rescue CD to mount the SIEM file system. Or If you need assistance, contact Technical Support.

Type the following command and press Enter:

IMPORTANT: Do not run the following command on an ESM. Run this command only on a Receiver, ELM, DBM, ACE, or other non-ESM appliance.

cat /etc/NitroGuard/factory-id_rsa.pub > /root/.ssh/authorized_keys2

Open the ESM user interface and rekey the device by clicking Device Properties, Key Management, Key Device.
Write down the password you specify because it is needed to log on to the device.

If these steps do not resolve the problem, see: KB83135 - SSH Connection Failed ER360 (when trying to rekey a SIEM device).

You can also contact Technical Support to troubleshoot the issue further.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Related Information

NitroSecurity ID: 15094-58

Affected Products

SIEM Advanced Correlation Engine 11.5.x
SIEM Advanced Correlation Engine 11.4.x
SIEM Advanced Correlation Engine 11.3.x
SIEM Advanced Correlation Engine 11.2.x (EOL)
SIEM Advanced Correlation Engine 11.1.x (EOL)
SIEM Database Event Monitor 11.4.x
SIEM Database Event Monitor 11.3.x
SIEM Database Event Monitor 11.2.x (EOL)
SIEM Database Event Monitor 11.1.x (EOL)
SIEM Enterprise Log Manager 11.5.x
SIEM Enterprise Log Manager 11.4.x
SIEM Enterprise Log Manager 11.3.x
SIEM Enterprise Log Manager 11.2.x (EOL)
SIEM Enterprise Log Manager 11.1.x (EOL)
SIEM Enterprise Security Manager 11.5.x
SIEM Enterprise Security Manager 11.4.x
SIEM Enterprise Security Manager 11.3.x
SIEM Enterprise Security Manager 11.2.x (EOL)
SIEM Enterprise Security Manager 11.1.x (EOL)
SIEM Event Receiver 11.5.x
SIEM Event Receiver 11.4.x
SIEM Event Receiver 11.3.x
SIEM Event Receiver 11.2.x (EOL)
SIEM Event Receiver 11.1.x (EOL)

Knowledge Center

How to reset the default factory key when SSH is not authorized

Environment

Problem

Cause

Solution

Related Information

Affected Products

Title

Title

Knowledge Center

How to reset the default factory key when SSH is not authorized

Environment

Problem

Cause

Solution

Related Information

Affected Products

Choose your region

Title

Title