How to enable UNIX Password and Passcode?

[NishanthShaga]

We are trying to lock down Linux server using RSA SecurID. Installed RSA Agent and test authentication is working. When we enable auth required pam_secureid.so in sshd file, it is prompting only for UNIX Password. 

If we disable other auth and enable only pam_secureid.so then it is prompting only for passcode without UNIX password. 

Can we enable both UNIX Password and Passcode for authentication? If yes, how can we achieve this configuration?

[SrirangaPrasan1 · Accepted solution]

Hi Nishanth,

If the user is a local user then the pam_securid module cannot password authenticate the user.So we would need a authentication method such as pam_unix that can password authenticate local users

If the users are are not local then the pam_unix module cannot password authenticate the user example -  LDAP users.
Therefore we would need another module such as pam_sss to deal with password authenticating these non-local users(LDAP users).

You can try using below auth methods and comment the rest of auth methods in the /etc/pam.d/sshd files
auth required pam_securid.so
auth substack password-auth

Where the user is first challenged for RSA authentication and then prompted for password authentication based on stacking defined in substack "password-auth"

-Sri

[NishanthShaga]

It worked!!!  

We tried to lockdown windows 2016 server as well using RSA SecurID Agent. It works but prompts for AD Password twice. 

1. When we RDP, it prompts for AD User ID and Password. 
2. RSA SecurID Passcode.
3. After successful authentication, again it prompts for AD Password. 

Any reason why it is prompting for AD Password twice... can we configure to prompt for AD Password only once?

RSA Agent Version : 7.4.3

[SrirangaPrasan1]

Kindly refer to below articles to achieve the use case of having to enter the windows password only once during the authentication

Replace Users' Windows Password with an RSA SecurID Passcode 

RSA Authentication Agent 7.4 for Microsoft Windows Installation and Administration Guide - Refer topic - Integration of Windows Passwords in the RSA SecurID Logon Process from page 11 onwards