SSH 2 Factor Authentication with RSA SecureID at INNODATA

Open the ports on the Firewall between the Server and RSA Server

10.120.51.85------------------------------ 10.100.0.75 5550 TCP

10.120.51.85------------------------------ 10.100.0.75 5580 TCP

10.120.51.85------------------------------ 10.100.0.75 5500 UDP

Get the server ip and hostname registered at RSA Server

Get the server ip and hostname registered at RSA Server and get the Latest Sdconf.rec file and place it in /var/ace

Download PAM authentication agent from RSA website.

Filename: PAM-Agent_v7.0.1.29.02_25_11_04_30_33.tar

Extract it

1. ./install.sh

Accept the License agreement

Select /opt/ace as root path for RSA authentication agent

Next message will be displayed as below

By this RSA authentication agent is installed on the server.

Now to test the connectivity go to

Cd /opt/ace/pam/bin/32bit

Run acestatus if successfully configured below screen will be displayed

Now to exclude the account which you don’t want to be included in Two factor authentication

Open /etc/sd_pam.conf

INCL_EXCL_USERS=0 0 exclude users from securid authentication

LIST_OF_USERS=root:ias

PAM_IGNORE_SUPPORT_FOR_USERS=1

By this your Server is configured to be two-factor authentication for ssh.

Make changes on “/etc/pam.d/sshd” file to apply two-factor authentication:

# vim /etc/pam.d/sshd

------------------------------------------------------------------

#%PAM-1.0

#auth include system-auth

auth optional pam_securid.so

account required pam_stack.so service=system-auth

password required pam_stack.so service=system-auth

session required pam_selinux.so close

session required pam_stack.so service=system-auth

session required pam_loginuid.so

session optional pam_console.so

auth required pam_unix.so

#account required pam_nologin.so

#account include system-auth

#password include system-auth

#session optional pam_keyinit.so force revoke

#session include system-auth

#session required pam_loginuid.so