Troubleshooting Tip: Consideration of SSH filter on SUSE server

Description

This article describes how to resolve issues caused by an incompatible shell prompt format when using an SSH filter profile in FortiPAM with a SUSE server.

Scope

FortiPAM, SUSE server.

Solution

The issue arises due to the shell prompt format on the SUSE server, which may be incompatible with the SSH filter profile.

For example:

In the screenshot below, note that there is no space before running the 'sudo su' command.

To ensure proper functionality of the SSH filter profile, the 'sudo su' command must be executed in the terminal. However, this is not an expected requirement.

To resolve the issue, execute the following steps:

Step 1: Update the shell prompt on the SUSE server. Run the following steps on the SUSE server using any terminal:

vi /root/.bashrc

Add or update the following line:

export PS1='\u@\h:\w> '

Note: Ensure there is a space after '>'.

Apply the changes:

source /root/.bashrc

Step 2: Modify SSH filter profile in FortiPAM.

If the requirement is only logging (and not restricting commands), configure the SSH filter profile in non‑restricted mode:

config ssh-filter profile
    edit "new"
        set restricted-mode disable
    next
end

For a more complete configuration:

config ssh-filter profile
    edit "new"
        set block x11 exec port-forward tun-forward sftp unknown
        unset log
        set restricted-mode disable
        set default-command-log enable
    next
end

Note: If only session logging is required, it is recommended to disable restricted-mode to avoid command parsing issues. The shell prompt format must remain consistent to ensure proper SSH filter functionality.