General Troubleshooting Jump to Content HomeDocumentationAPI Reference v16v17v18v19v20v21v22v23v24v25 Log In Log In v25 HomeDocumentationAPI Reference Search Getting Started Quick Start Guide Quick Server Setup Your First SSH Connection Certificate Authentication for OpenSSH Connections Importing Users from Active Directory Configuring SSH Target Host to Accept PrivX Connections Importing Hosts from AWS Search Syntax Deployment Overview Release Notes for This Release Preparing for Deployment Get PrivX software Setting up PrivX Components Deploying PrivX to Amazon Web Services Deploying PrivX to Google Cloud Platform: architecture blueprint Deploying PrivX to Azure: architecture blueprint Deploying to Kubernetes High-Availability Deployment License Management Example Nginx Load-Balancer Configuration Native SSH and RDP clients Production-Readiness Checklist Backup and Restore Users and Permissions Adding PrivX Users Importing Users from AD/LDAP Granting User Permissions Managing Roles Requesting and Approving Memberships Granting Access to Hosts Granting Administrator Permissions Access Groups Role Permissions Managing Workflows Enabling Email Notifications User Configuration Automatic Logout Require Password Change Limiting Login Rate Additional Authentication Methods Kerberos Authentication Multi-Factor Authentication Client-Certificate Authentication OpenID-Connect Authentication Public-Key Authentication (SSH Bastion) External JWT Authentication Managing User Secrets Password Change for AD and LDAP Users Authenticating to Hosts Supported Authentication Methods SSH Certificate Authentication RDP Certificate Authentication VNC Certificate Authentication Script-Based Certificate-Authentication Setup Certificate-Authentication Setup via ​Chef​​ Manual Certificate-Authentication Setup SSH X.509 Certificate Authentication Public-Key Authentication Stored Passwords Example VNC-Server Setup Trusting Target-Host Identities Connection Management Setting up Hosts Connecting via the PrivX GUI SSH Connections with Native Clients RDP Connections with Native Clients Network Targets Website Access via PrivX AWS CLI Connection with Native Client Monitoring and Managing Connections Restricting Users' Access to Applications in RDP Connections Automatic M2M SSH Connections Auditing Viewing Audit Data SIEM Integration Session Recording External Logging Matching Certificate-Based-Login Messages Audit Events Reference Splunk integration Advanced Configuration Best practices SSL/TLS Security PrivX-Server Configuration Extender Configuration Carrier and Web Proxy Configuration API-Client Integration Automation with Golang SDK Automation with Python-SDK Configuring ephemeral credential access for AWS API Authentication to AWS Services using AWS CLI Fetching ephemeral AWS Services credentials via PrivX Configuring assume-role access to AWS API Configuring Federated Token Access to AWS API Certificate authentication for code repositories GitHub Enterprise integration GitLab Integration PrivX CA as Sub CA in CA Hierarchy X.509 Certificate Name Constraints Validating X.509 Access Certificates Network Target Access PrivX Router Configuration Network Target Extender Support Rotating Stored Passwords SSH Command Restrictions Example SSH Command Restrictions Configuration Integrations User Directories AWS Cognito as a User Directory Google Workspace as a User Directory JumpCloud as a User Directory Azure AD as a User Directory via Microsoft Graph API Azure AD as a User Directory via Azure Graph API Azure AD as User Directory via LDAPS Host Directories AWS EC2 as a Host Directory Google Cloud Platform as a Host Directory HSM Providers AWS CloudHSM as a HSM Provider nShield connect as an HSM Provider SafeNet Luna SA as a HSM Provider SCIM ICAP Servers Troubleshooting General Troubleshooting Connections fail with error ​Too many Authentication Failures​​ ​ Directory Users Are Not Listed List Users View Does Not Display All Attributes Resolving x509: Common Name certificate error All microservices fail to start except Keyvault Deploy script fails to trust AWS CA TLS certificate Windows login failures Windows revocation failures OpenSSH 7.8 Client Not Supported Error "smart card logon is not supported for your user account " Hosts with "Directory" Account Enabled Not Visible in Connections Login with Correct Username and Password Fails All Microservices apart from Keyvault Down AD That Has Previously Worked Fails Error "Administratively prohibited" with Native Clients and Extenders Error "Unable to connect to Extender/Carrier" during Web Connections Error "Unable to connect to Web Proxy" during Web Connections Error "The proxy server is refusing connections" during Web Connections Error "Host Cannot be redeployed" when Deploying a New Cloned Host Error "Bad configuration option: AuthorizedPrincipalsCommand" when running the deploy script Microsoft Remote Desktop version 10 for Mac Does Not Display Text Error "proxy server is refusing connections" during Web Connections on RHEL8 RDP native client times out Error "USER-STORE [ERROR] Server error: listen tcp :8084: bind: address already in use" when running in Azure OIDC Login "[ERROR] DB connection failure: x509: certificate has expired or is not yet valid. Retrying in 15 seconds.." File transfer in RDP session is slow Error "Remaining connection slots are reserved for non-replication superuser connections" Permission errors when accessing PrivX audit folders Password rotation does not work for Windows 2012 R2 Extender fails to register to PrivX because certificate expired Knowledge Base PrivX microservices architecture PrivX web access architecture Websockets and the PrivX Carrier browser Customizing the PrivX Carrier browser PrivX RDP Admin Access Deployment in Multi-Domain Environment Vault and M2M Onboarding SSH target hosts to PrivX via Ansible Onboarding SSH target hosts to PrivX via Chef Onboarding AWS, Azure & Google Cloud SSH target hosts the simple way Enabling TLS 1.3 Removing Hosts from Directories Configuring GitLab access through PrivX SSH certificate authentication Example Nginx Load-Balancer Configuration PrivX Analytics Connection method vs feature matrix Setting up and upgrading PrivX with custom network ports Supported SSH Algorithms Supported SFTP Protocol Versions PrivX Settings Granting Password-based root Access via Roles Requesting and Granting Roles, Passwordless Access Passwordless SSH and RDP Access PrivX AWS High Availability Installation With Two ELBs How to install PrivX OSS Acknowledgements End-user license agreement (EULA) Documentation Conventions PrivX Settings Examples Previous Releases and Notes Release Notes 1.x - 9.x Release Notes 10.x - 19.x Changing to the New License Back End PrivX Login Flow and State Storage Changing PrivX database name, username or password Changing notification mechanism to PostgreSQL Migrate to Rocky Linux Merging changes on Extender/Carrier/WebProxy upgrade Mapping Directory Users to Additional Accounts Upgrade from Older Releases PrivX Comparisons Kerberos Guacamole FAQ Auditing & Reporting Architecture Authentication, Access Control and Identity Management Buying and Trying Compliance Connectivity Data Encryption Data Retention Functional Use Cases Integrations and System Monitoring Licensing Miscellaneous Operational Security & Maintenance Operational Technology (OT) PrivX Components Product Info Product Features Security Session Recording and Playback Support and Services Tips and Tricks General Troubleshooting Suggest Edits This article describes troubleshooting practices that are applicable to various problem scenarios. Checking Microservice Status You can verify the microservice statuses on the status page, available at (replace ​ https://privx.example.com​​ with the address of your PrivX server: ​ ​​​https://privx.example.com​​/privx/status Restarting PrivX Some issues may be fixed by restarting the PrivX services. You can do this by running the following command on your PrivX servers: # systemctl restart privx 📘 Note If microservices report 502 errors, check the database connectivity. If running local DB server, make sure the ​pg_hba.conf​ on the PostgreSQL server allows PrivX servers to connect to the PrivX database with ​md5​​ authentication (PostgreSQL 9.2 - 9.6, on CentOS 7) or scram-sha-256 authentication (from PostgreSQL 10 onwards). More information about the error may be provided by the microservice logs. Getting Debug Logs You can enable debug logging per microservice, as described in PrivX Log Settings. By default, microservices log to /var/log/privx/ as follows: MICROSERVICE LOG LOCATION Authorizer ​​/var/log/privx/authorizer.log​​ Connection Manager /var/log/privx/connectionmanager.log Hoststore ​​/var/log/privx/hoststore.log Keyvault /var/log/privx/keyvault.log​ Monitor ​​​​/var/log/privx/monitorservice.log OAuth2 ​​/var/log/privx/auth.log RDP Bastion /var/log/privx/rdpmitm.log RDP Proxy ​​/var/log/privx/rdpproxy.log RDP-Trail Encoder /var/log/privx/redemption.log Role Store /var/log/privx/rolestore.log SSH Bastion /var/log/privx/sshmitm.log SSH Proxy /var/log/privx/sshproxy.log Trail Indexer ​​/var/log/privx/trail-indexer.log Userstore ​​/var/log/privx/userstore.log Watchdog /var/log/privx/watchdog.log Workflow Engine /var/log/privx/workflowengine.log The logs are also visible on /var/log/messages. Problems Related to Authentication More information about authentication issues may be found from syslog messages. ​ Since PrivX uses short-term certificates for user authentication, deviations in system times (minutes or more) will easily result in failing authentications. It is extremely important to synchronize the clocks between all the involved systems: PrivX servers Hosts serving as connection endpoints. We strongly recommend using authenticated NTP clock synchronization on all the involved systems. Contacting Support You can request technical support and let us know about PrivX issues on the SSH Communications Security support site. When submitting a support ticket, please include following details: Detailed description about the error: Causes: User actions and steps that caused the error, screenshot of the error, and/or details about the error message. Occurrence: Is the error reproducible? Has it worked before? Impact: Does it happen to a specific entity (user, connection, hosts, etc), or to multiple entities? Related configurations in PrivX admin UI. For example if the error is regarding a user cannot connect to a host, take some screenshots of the host configuration, screenshots of user's details and roles Troubleshooting data To generate troubleshooting data, run the following on your PrivX server: # /opt/privx/scripts/troubleshoot.sh info And attach the generated troubleshooting-data package to the support ticket. By default the package is generated to the current working directory, with the name: ​​Privx-troubleshoot-data-​​<host>​​-​<timestamp>​​.tar.gz​​ 📘 Note If PrivX service is completed or partially down, please run the troubleshooting script and collect the data when the problem is happening. 🚧 Caution Troubleshooting data may contain security critical data, and must be distributed with appropriate care. For additional usage instructions related to the troublehsooting script, you may run: # /opt/privx/scripts/troubleshoot.sh -h Updated 12 months ago Did this page help you? Yes No Table of Contents Checking Microservice Status Restarting PrivX Getting Debug Logs Problems Related to Authentication Contacting Support