After installing RSA SecurID Authentication Agent for PAM, you may need to configure Linux password authentication to run alongside SecurID authentication — either to require both a passcode and a system password, or to restrict SecurID challenges to specific user groups only. This article uses the SSH service (sshd) as the configuration example. The same steps apply to other PAM-enabled services such as su and sudo.

Prerequisites:

• RSA SecurID Authentication Agent for PAM is installed and basic configuration is complete
• Root or sudo access on the Linux server
• SSH service (sshd) is running
• Access to edit /etc/pam.d/sshd and /etc/sd_pam.conf

Use this table to identify which scenario matches your requirement, then jump directly to that section.

Shared Configuration Details:

Scenario : Require Passcode + System Password for Challenge-Group Users1

Enable SecurID users in the challenge group to enter a passcode (PIN + tokencode) then the system password while users who are not part of SecurID challenge group only enter their system password

1. Login to the server on which the RSA Authentication Agent for PAM is installed.
2. Change to root:

sudo su - root

3. Navigate to /etc/pam.d:

cd /etc/pam.d

4. Make a copy of the sshd file:

cp ./sshd > ./sshd.rsabackup

6. Using a text editor, edit /etc/pam.d/sshd:

vim /etc/pam.d/sshd

7. Modify the file so the pam_securid.so and pam_unix.so values are as follows: 

auth    required        pam_securid.so
auth    required        pam_unix.so

8. Edit the sd_pam.conf to ignore users that are not in the SecurID challenge group:
   1. Login to the server on which the PAM agent is installed.
   2. Change to root:

su - root

3. Navigate to /etc:

cd /etc

4. Take a backup of the sd_pam.conf file.

cp ./sd_pam.conf > ./sd_pam.conf.rsabackup

9. Edit the sd_pam.conf:

vim /etc/sd_pam.conf

10. Here is where you configure to ignore users who are not challenged by SecurID; meaning if, from this same file, you excluded users or groups from SecurID authentication, then the SecurID PAM module will be transparent to them, and from the configuration in the previous file we see it will jump directly to the Unix system password challenge only.  To do this, add the following entries to the file with a value of 1 to ignore users and groups:

PAM_IGNORE_SUPPORT_FOR_USERS=1
PAM_IGNORE_SUPPORT=1

Verify: Open a new SSH session (do not close the current one) and log in as a challenge-group user. Confirm the user is prompted for both the SecurID passcode and the Linux system password. Log in as a non-challenge-group user and confirm they are prompted for the system password only.

sudo su - root

cd /etc/pam.d

cp ./sshd > ./sshd.rsabackup

vim /etc/pam.d/sshd

auth    required        pam_securid.so

cd /etc
cp ./sd_pam.conf > ./sd_pam.conf.rsabackup

vim /etc/sd_pam.conf

INCL_EXCL_USERS=1
LIST_OF_USERS=<someUser>
PAM_IGNORE_SUPPORT_FOR_USERS=0

PAM_IGNORE_SUPPORT_FOR_USERS=0

Notes for Scenario 1

• The entry for pam_unix.so performs authentication with the usual Unix password files, /etc/passwd and /etc/shadow. 
• For other flavors of Unix, the name of the pam_*.so file may change.  An internet search for <OS> system password pam module will list other versions.
• The required entry means that all required modules in a stack must pass for a successful result. If one or more of the required module fails, all of the required modules in the stack are implemented, but the first error is returned.
• The two lines of auth required pam_securid.so and auth required pam_unix.so will have a user authenticate with their SecurID passcode and then their Linux system password.