connection aborted error sometimes.

[kaushik28]

Check Point's Linux SNX  (for rhel7 )

build 800010003

 when I used -g option the log has following erors for failed login attempt:  

CP_gethostbyname Failed to resolve hostname ‘fqdn’

rand_add_seedfile Failed to read seed from registry Operation not permitted

fwrand_write_seed Failed to read seed from registry Operation not permitted

fwrand_write_seed Failed to write seed Operation not permitted snx_browser Failure entering with code: 3

Only few users are getting this error.  otherwise for most other users it establishes fine on the same host.

[PhoneBoy]

When you say "on the same host" what precisely do you mean?
User A on host X is successful, but user B on host X is not?
Are they doing it at the same time or different times?
If you create a brand new user on the same host, does it work?
Please clarify the situation and include the version/JHF level of the gateway you are connecting to.

[kaushik28]

User A on host X is successful, but user B on host X is not?  correct
Are they doing it at the same time or different times?  different  (snx won't start again if session already exists)
If you create a brand new user on the same host, does it work?  (it works for all other new or old users)
Please clarify the situation and include the version/JHF level of the gateway you are connecting to. (its snx build 800010003 foe linux - not sure how to find out JHF level)

[kaushik28]

Basically these are the two scenarios:

scenario A (BAD)

i am logged in to hostX as Jim, starting snx as userA

jim@hostX >>  /usr/bin/snx -s server.fqdn -u userA -g

Check Point's Linux SNX

build 800010003

Please enter your password:

<<There is NO prompt for Root Cert y or n>>

connection aborted.

scenario B (GOOD)

i am logged in to hostX as nancy, starting snx as userA

nancy@hostX >>  /usr/bin/snx -s server.fqdn -u userA -g

Check Point's Linux SNX

build 800010003

Please enter your password:

Prompted to accept the Root Cert GUE DGP KOP PNE : y or n 

y

SNX - connected.

[_Val_]

Seems like those users do not have full admin rights.

[kaushik28]

it worked for months before it stopped working.  on the same host other profile can start snx with no issue.  

another key is that the user  who can't start snx anymore , is not being prompted for the < accept root cert > 

[PhoneBoy]

That all points to a preference stored in the user's home directory.
I don't recall what SNX uses offhand, but I'd recommend reviewing the contents of the user's home directory for a dot directory.
My bet is if you remove the relevant dot directory (maybe .snx), it should start working again.

[kaushik28]

couldn't locate anything thing specific to snx in home.  only thing i see is the cert saved for each local user in /etc/snx/user.db 

i have tried removing/renaming that but not luck.  It causes no change in the user's behaviour for snx.

[PhoneBoy]

Your best bet here is to open a TAC case.