IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Permission denied(Publickey)

    Posted Mon May 31, 2021 03:31 PM
    Hello Experts,

    I am unable to ssh into a managed host (EP) from the console, I received the message below.

    Permission denied (Publickey).

    Regards,

    ------------------------------
    benlinux
    ------------------------------


  • 2.  RE: Permission denied(Publickey)

    Posted Tue June 01, 2021 08:55 AM
    On the console did you switch to the root account? "sudo su -". This always gets me.



    Original Message


  • 3.  RE: Permission denied(Publickey)

    Posted Tue June 01, 2021 10:22 AM
    Edited by benlinux Tue June 01, 2021 10:22 AM
    Hello Lewis,

    I switched to root, confirmed with whoami. I can ssh into other managed hosts like FP, Apphost, but i cant seem to ssh into the Event processor from the console.

    From the system and license management page, the Event processor is "Active"

    Regards,

    ------------------------------
    benlinux
    ------------------------------

    Original Message


  • 4.  RE: Permission denied(Publickey)

    Posted Tue June 01, 2021 11:27 AM
    Here is an old post about a similar issue (different direction). I think I have only had to do this once in my Qradar history: https://www.ibm.com/support/pages/qradar-unable-ssh-managed-host-console-qradar-720-724

    Alternatively, directly login to the EP using its root password (hopefully saved during install) and check out the authorized servers list. if the consoles public key is not there its easy to copy over.

    End of the day open a support ticket as this is fundamental to how QR talks to each other.




    Original Message


  • 5.  RE: Permission denied(Publickey)

    Posted Wed June 02, 2021 02:29 AM
    Edited by benlinux Wed June 02, 2021 02:30 AM
    Hello Lewis,

    Thank you for the link, but it applies to 7.2.0 to 7.2.4, I am running 7.4.2.

    I will involve support.

    Regards,

    ------------------------------
    benlinux
    ------------------------------

    Original Message