RSA MFA Agent 9.x for PAM/Unix

To be successful with installing, configuring and using the MFA for Unix agent, please follow these best practices:

• Make sure your firewall allows bidirectional traffic on 5555 between the agent and all Authentication Manager servers.
• Be sure to open 5555 on all Authentication Manager servers in your deployment via the Security Console under Settings > Authentication API.
• Before installing, be sure that SELinux is disabled. Following the steps on page 24 of the MFA Agent 9.1 for UNIX Installation and Configuration Guide for RHEL and Ubuntu, you can reenable it after the agent is installed.
• Turn off fapolicyd. It has not been qualified for use with the MFA Agent for PAM/Unix.
• Disable Trellix as it can restrict access to the file system until decryption or security policies are fully applied. The MFA Agent requires uninterrupted access to certain files and libraries during authentication. If Trellix blocks or delays this access, it causes authentication to fail. Hence, environments with Trellix installed and active are not supported.
• As mentioned on page 16 of the MFA Agent 9.1 for UNIX Installation and Configuration Guide for RHEL and Ubuntu, be sure the certificate is in .pem format.
• You can enable ENABLE_USER_SUPPORT OR ENABLE_GROUP_SUPPORT, but not both.
  • For users, ensure that the user that you want challenged is a local user on the box. Edit /etc/sd_pam.conf to add the user. For example,

LIST_OF_USERS=root:administrator:sroberts

• To add local users, run the useradd command (sudo useradd sroberts). Failure to do this step will result in errors when testing authentication.
• For groups, ensure that the group that you want challenged is a local group on the box. Edit /etc/sd_pam.conf to add the group. For example, 

LIST_OF_GROUPS=admins:secops:security

• To add local groups, run the groupadd command (sudo groupadd secops). Failure to do this step will result in errors when testing authentication.
• Please review these documents for additonal information:
  • Editing the RSA MFA Agent 9.0 on RHEL 9.4 to enable ChallengeResponseAuthentication (Note that on RHEL 9 the file called 50-redhat.conf in /etc/ssh/sshd_config.d).
  • RSA MFA Agent 9.1 for UNIX Installation and Configuration Guide for RHEL and Ubuntu.