Is Authentication Agent available on macOS/OS X?

[NicholasWilson1]

Hi, I can find the downloads of the Authentication Agent for Windows, and for Linux+AIX (using PAM), but I can't see anything about macOS/OS X, which also uses PAM and presumably would work identically to Linux/AIX - only I can't find the download. Surely you don't have more AIX than macOS customers!

Thanks,

Nick

[LukaKodric]

As far as I know there is no Authentication Agent for macOS.

[NicholasWilson1]

Thanks for confirming that!

[JayGuillette]

Vote for a MAC agent on the RSA Ideas page for SecurID

[Kenn_Chong · Accepted solution]

Hi Nicholas Wilson‌,

We have just released our first RSA MFA Agent 1.0 for macOS. Read all about it here: 

https://community.rsa.com/community/products/securid/blog/2020/06/23/cake-for-all-secure-convenient-login-for-the-new-enterprise-for-macos 

[AshokReddyDurge]

Hi kenn Chong,

Use case: we have some mac mini boxes and we want install an authentication agent on those boxes to challenge the user to login via SSH with the RSA passcode . So could you help me which authentication agent i need to install on this Mac Mini boxes. { NOTE: these are server boxes, at this moment no GUI, login with only SSH connection}

How the configurations has to be made on the agent side(Mac Mini box) side in order to make a communication channel between RSA AM and agent. 

Thanks in advance,

Ashok.

[JerLaw]

Documentation states the requirement of RSA Cloud Authentication subscription.  Is there any near term plan for on prem Authentication Manager options?  Cloud is something we are 100% restricted from doing and would like to stop using another solution as soon as possible.

Thanks,

Jeremy

[JayGuillette]

The MAC agent Kenn announced is for a MAC console, so it won't protect an SSH connection.

Do you know much about MAC SSH authentication, maybe with PAM, can it be configured to authenticate against a RADIUS Server?  If yes, you might be able to configure these MAC mini boxes as RADIUS clients in the Authentication Manager Security Console, with associated agents.

On MAC mini you would configure to authenticate against RADIUS and enter one or more of the AM servers IP addresses, one as primary and second as fail-over.  The only difficult thing is making sure the RADIUS shared secret configured on the MAC is the same as you configured for the RADIUS Client entry for the MAC in the Security Console.  Try simple first, once working  make it complex.

This is just simple RADIUS authentication, but with an RSA Passcode for a user in Authentication Manager.  It might only work when you only enter Passcode, it might not work on those occasions when you have to enter something that takes two steps, such as New PIN mode and Next Token Code mode.

[JayGuillette]

Yeah, I double checked, MFA agent means the SID Access Cloud, this agent only works with the IDR, not Authentication Manager ver. 8.x.  There're no references to sdconf.rec, authentication manager, agent host in the release notes,

https://community.rsa.com/docs/DOC-112783 

so this version is Cloud Authentication Service only.

[AshokReddyDurge]

Hi Jay Guilette,

Do you know much about MAC SSH authentication, maybe with PAM, can it be configured to authenticate against a RADIUS Server? No, I do not know. That is the reason I asked for the RSA expertise professional help. 

Does RSA implemented this kind of use case in the past with any of the RSA clients?

could you just elaborate more each step how to do the process.

Thanks,

Ashok.