IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Data Gateway Deployment QROC (SSH Failed)

    Posted Tue June 02, 2020 09:14 AM
    Hi everyone,

    so I have been installing a few times Data Gateway however I have been trying to troubleshoot an installation that has been giving me a weird error. As such the installation is with the iso file :
    -  Rhe764QRadar7_3_3_20191031163225.stable-7-3-3.iso
    and the patch : 
    - 733_QRadar_patchupdate-7.3.3.20191203144110.sfs

    Now the moment i installed the iso based on all the requirements from IBM and opening the ports as it should I noticed i cannot ssh into the server and this is weird because on the telecom team we can see the port is open and when looking into the Data Gateway I see the TCP connection is established at first but then it is not accepted saying the following error : RSA Fingerprint Key is missing.
    I have never seen this error however when doing :
    ls -al ~/.ssh/id_* i received the following statement that no file or directory exist.... 

    Has anyone ever seen such an error ?
    Regards,
    Alexandre Laquerre

    ​

    ------------------------------
    Alexandre Laquerre
    SOC Analyst
    ------------------------------


  • 2.  RE: Data Gateway Deployment QROC (SSH Failed)

    Posted Wed June 03, 2020 10:24 PM
    Hello,

    I have not seen the error.

    Not sure this will help but check your data gateway version matches your console version exactly.


    If your console is at 7.3.3 FixPack 1 (Build 20191203144110) with interim fix IF01 then the Data Gateway should have the interim fix IF01 installed as well before adding to deployment.

    Please find release information here https://www.ibm.com/support/pages/qradar-master-software-version-list-release-note-list-updated#73

    Regards,
    Matt Tobin
    QRoC DevOps



    ------------------------------
    Matthew TOBIN
    ------------------------------

    Original Message


  • 3.  RE: Data Gateway Deployment QROC (SSH Failed)

    Posted Wed June 03, 2020 11:22 PM
    Hi Matthew,

    thank you for information. I have downloaded the patch and will apply it tomorrow, it is still weird that I cannot SSH into the VM after the installation of the Data Gateway due to the face that no RSA Fingerprint Key is created.... 

    I will keep you posted.
    Regards,
    Alexandre Laquerre
    SOC analyst

    ------------------------------
    Alexandre Laquerre
    ------------------------------

    Original Message