SSH 2 Factor Authentication with RSA SecureID at INNODATA
- Open the ports on the Firewall between the Server and RSA Server
10.120.51.85------------------------------ 10.100.0.75 5550 TCP
10.120.51.85------------------------------ 10.100.0.75 5580 TCP
10.120.51.85------------------------------ 10.100.0.75 5500 UDP
- Get the server ip and hostname registered at RSA Server and get the Latest Sdconf.rec file and place it in /var/ace
3.Download PAM authentication agent from RSA website.
Filename: PAM-Agent_v7.0.1.29.02_25_11_04_30_33.tar
- Extract it
[[Image:]]
- ./install.sh
[[Image:]]
Accept the License agreement
[[Image:]]
Select /opt/ace as root path for RSA authentication agent
[[Image:]]
Next message will be displayed as below
[[Image:]]
[[Image:]]
By this RSA authentication agent is installed on the server.
Now to test the connectivity go to
Cd /opt/ace/pam/bin/32bit
[[Image:]]
Run acestatus if successfully configured below screen will be displayed
[[Image:]]
Now to exclude the account which you don’t want to be included in Two factor authentication
Open /etc/sd_pam.conf
INCL_EXCL_USERS=0 0 exclude users from securid authentication
LIST_OF_USERS=root:ias
PAM_IGNORE_SUPPORT_FOR_USERS=1
[[Image:]]
By this your Server is configured to be two-factor authentication for ssh.
Make changes on “/etc/pam.d/sshd” file to apply two-factor authentication:
# vim /etc/pam.d/sshd
------------------------------------------------------------------
#%PAM-1.0
#auth include system-auth
auth optional pam_securid.so
account required pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
session required pam_selinux.so close
session required pam_stack.so service=system-auth
session required pam_loginuid.so
session optional pam_console.so
auth required pam_unix.so
#account required pam_nologin.so
#account include system-auth
#password include system-auth
#session optional pam_keyinit.so force revoke
#session include system-auth
#session required pam_loginuid.so