Editing SSH 2 Factor Authentication with RSA SecureID at INNODATA

[[category:INNODATA]]

=='''SSH 2-Factor Authentication with RSA SecureID'''==


=='''Open the ports on the Firewall between the Server and RSA Server'''==

'''10.120.51.85------------------------------ 10.100.0.75 5550 TCP'''

'''10.120.51.85------------------------------ 10.100.0.75 5580 TCP'''

'''10.120.51.85------------------------------ 10.100.0.75 5500 UDP'''


=='''Get the server ip and hostname registered at RSA Server'''==

Get the server ip and hostname registered at RSA Server and get the Latest Sdconf.rec file and place it in /var/ace

=='''Download PAM authentication agent from RSA website.'''==

'''Filename: PAM-Agent_v7.0.1.29.02_25_11_04_30_33.tar'''

=='''Extract it'''==

[[Image:rsa-1.png]]

# '''./install.sh'''

[[Image:rsa-2.png]]


=='''Accept the License agreement'''==

[[Image:rsa-3.png]]


=='''Select /opt/ace as root path for RSA authentication agent'''==

[[Image:rsa-4.png]]

=='''Next message will be displayed as below'''==

[[Image:rsa-5.png]]


[[Image:rsa-6.png]]

'''By this RSA authentication agent is installed on the server.'''


=='''Now to test the connectivity go to'''==


Cd /opt/ace/pam/bin/32bit


[[Image:rsa-7.png]]


Run acestatus if successfully configured below screen will be displayed


[[Image:rsa-8.png]]


Now to exclude the account which you don’t want to be included in Two factor authentication


Open /etc/sd_pam.conf


INCL_EXCL_USERS=0 0 exclude users from securid authentication

LIST_OF_USERS=root:ias

PAM_IGNORE_SUPPORT_FOR_USERS=1


[[Image:rsa-9.png]]


By this your Server is configured to be two-factor authentication for ssh.


'''Make changes on “/etc/pam.d/sshd” file to apply two-factor authentication:'''

'''<nowiki># vim /etc/pam.d/sshd</nowiki>'''

'''<nowiki>------------------------------------------------------------------</nowiki>'''

'''<nowiki>#%PAM-1.0</nowiki>'''

'''<nowiki>#auth </nowiki>include system-auth'''

'''auth optional pam_securid.so'''

'''account required pam_stack.so service=system-auth'''

'''password required pam_stack.so service=system-auth'''

'''session required pam_selinux.so close'''

'''session required pam_stack.so service=system-auth'''

'''session required pam_loginuid.so'''

'''session optional pam_console.so'''

'''auth required pam_unix.so'''

'''<nowiki>#account </nowiki>required pam_nologin.so'''

'''<nowiki>#account </nowiki>include system-auth'''

'''<nowiki>#password </nowiki>include system-auth'''

'''<nowiki>#session </nowiki>optional pam_keyinit.so force revoke'''

'''<nowiki>#session </nowiki>include system-auth'''

'''<nowiki>#session </nowiki>required pam_loginuid.so'''