Hi, I can find the downloads of the Authentication Agent for Windows, and for Linux+AIX (using PAM), but I can't see anything about macOS/OS X, which also uses PAM and presumably would work identically to Linux/AIX - only I can't find the download. Surely you don't have more AIX than macOS customers!
Thanks,
Nick
As far as I know there is no Authentication Agent for macOS.
Thanks for confirming that!
Hi Nicholas Wilson,
We have just released our first RSA MFA Agent 1.0 for macOS. Read all about it here:
Cake for All! Secure & Convenient Login for The New Enterprise for macOS®
Hi kenn Chong,
Use case: we have some mac mini boxes and we want install an authentication agent on those boxes to challenge the user to login via SSH with the RSA passcode . So could you help me which authentication agent i need to install on this Mac Mini boxes. { NOTE: these are server boxes, at this moment no GUI, login with only SSH connection}
How the configurations has to be made on the agent side(Mac Mini box) side in order to make a communication channel between RSA AM and agent.
Thanks in advance,
Ashok.
The MAC agent Kenn announced is for a MAC console, so it won't protect an SSH connection.
Do you know much about MAC SSH authentication, maybe with PAM, can it be configured to authenticate against a RADIUS Server? If yes, you might be able to configure these MAC mini boxes as RADIUS clients in the Authentication Manager Security Console, with associated agents.
On MAC mini you would configure to authenticate against RADIUS and enter one or more of the AM servers IP addresses, one as primary and second as fail-over. The only difficult thing is making sure the RADIUS shared secret configured on the MAC is the same as you configured for the RADIUS Client entry for the MAC in the Security Console. Try simple first, once working make it complex.
This is just simple RADIUS authentication, but with an RSA Passcode for a user in Authentication Manager. It might only work when you only enter Passcode, it might not work on those occasions when you have to enter something that takes two steps, such as New PIN mode and Next Token Code mode.
Hi Jay Guilette,
Do you know much about MAC SSH authentication, maybe with PAM, can it be configured to authenticate against a RADIUS Server? No, I do not know. That is the reason I asked for the RSA expertise professional help.
Does RSA implemented this kind of use case in the past with any of the RSA clients?
could you just elaborate more each step how to do the process.
Thanks,
Ashok.
The short answer is RSA SecurID Authentication Manager does not support MAC mini box server clients or MAC remote console SSH, it only supports an MFA MAC client for console authentication against the SecurID Cloud service.
My point in mentioning RADIUS is a lot of clients for various VPN appliances and PAM modules support RADIUS, and RADIUS is a way to provide 2 factor authentication with Authentication Manager. RADIUS connections are only supported if there is a Partner Guide, but in this case 'not supported' does not mean if won't work, it means if you find a bug, RSA Engineering will probably want you to reproduce the bug on a supported platform, so 'not supported' carries some risk.
so if I want to try the RADIUS 2FA for Mac Mini box, could you provide the RSA documentation which explains how and what configuration to make on the end point side(Mac mini box side). That would be greatful.
Thanks,
Ashok.
Ashok,
You would have to look at MAC documentation to see where Authentication is configured, and find where you can select RADIUS Authentication, then it would be a matter of configuring the IP address of a replica or two.
Have a look at this KB to get a quick understanding of how to configure a RADIUS client.
000014905 - Performing RADIUS authentication tests with NTRadPing to RSA Authentication Manager
Hi Jay Guillette.
I just have one question regarding radius client authentication request flow, in the config file on the radius client side if I add 10 radius servers. For instance.
#Server Secret Timeout
XXXXXXX xxxxx 60
XXXXXXX XXXXX 30
.... similar 8 servers
based on what algorithm the request hits the radius server from radius client, I mean like first server does not respond then it goes to second server then if both first and second does not respond then it goes to the third server.. till 10th server. could you explain the authentication flow or else could you provide me any document that explains that.
The RADIUS protocol only has failover, not load balancing. This means the first RADIUS server that the client sends authentication request to has to fail or not respond, in order for the RADIUS client to try the second RADIUS server in the list. How long it takes to Fail-over is a product of both the Re-transmission Timer or Timeout and the Number of Re-transmission attempts or times. Both of these can be configured in a RADIUS Client.
For example, if you had 12 NTRadPing.exe RADIUS clients with the following configuration of a 6 second time out re-Transmission timer, with 2 Retries,
It would take 18 seconds before NTRadPing RADIUS client failed over to the second RADIUS server in the list, that is 1st attempt plus 2 retries = 3 total tries, times 6 second timeout, 3 * 6 = 18. These numbers a lean, but good. Anything less than 5 seconds for a time-out does not give the RADIUS server enough time to reply, and this can cause problems when the RADIUS Client re-transmits or re-sends an authentication request, which passes the RADIUS server authentication response on the Ethernet, and when re-transmission reaches the RADIUS Server, RADIUs server sees the same token Passcode used a second time and automatically flags it as a Re-Use Attack, and shuts down the user Authentication, changing the initial success to a re-use failure. !0 second re-transmission timeouts are considered the norm or average, and that single change from 6 seconds to 10 seconds would make the fail-over total time go from 18 seconds to 30 seconds (3 total transmits x 10 seconds time-outs).
I consider 5 retries high, usually a waste of time, because if the RADIUS server does not respond after 3 attempts, it probably is not going to respond after 2 more tries.
So with 12 RADIUS clients with my original lean numbers; 2 retries with 6 second timeout for 18 second failover, two things have to be true in order to ever send an authentication request to the 12th RADIUS Server in the fail-over list;
1. All 11 RADIUS servers before or in front of the 12th RADIUS Server have to be down or unreachable, and
2. The RADIUS client would take 198 seconds, or 3 minutes and 18 seconds, before the RADIUS Client would even send its first authentication request to the 12th server. Or 330 seconds with 10 second timeouts and 2 retires, 5.5 minutes.
Some products like NetScaler or an F5 Load Balancer can be configured to load balance across serveral RADIUS servers, but that is proprietary and not part of RADIUS protocol.
Other options include reversing the list or mixing it up, so different RADIUS clients go to different RADIUS servers first. That's a manual process, you'd need to document it.
Hello Jay Guillette
Thanks for your response.
Here we are using Pluggable Authentication Module (PAM) "pam_radius-release_1_4_0.tar.gz", so in this module let's assume we cannot write number of retries, we can only write timeout parameter
#Server Secret Timeout
XXXXXXX xxxxx 60
XXXXXXX XXXXX 30
then if the first radius server does not respond in 60 seconds, can I assume then the request goes to the second radius server or else it just time out and disconnect the connection. let's consider if it sends the request to the next server in the list, if the token code life span is 30 seconds, then when second server sends the token code to authentication manager and authentication manager recognizes the token is not valid token code and might throw an error. so,if in the 2nd attempt if user tries to login, then again request goes to the first server and the cycle might repeat right. As a result user never be able to perform 2FA on the RADIUS client. correct me if I am wrong and let me know how we can resolve this issue.
Documentation states the requirement of RSA Cloud Authentication subscription. Is there any near term plan for on prem Authentication Manager options? Cloud is something we are 100% restricted from doing and would like to stop using another solution as soon as possible.
Thanks,
Jeremy
Yeah, I double checked, MFA agent means the SID Access Cloud, this agent only works with the IDR, not Authentication Manager ver. 8.x. There're no references to sdconf.rec, authentication manager, agent host in the release notes,
RSA MFA Agent 1.0 for macOS Release Notes
so this version is Cloud Authentication Service only.
Hi Nicholas Wilson,
We have just released our first RSA MFA Agent 1.0 for macOS. Read all about it here:
Cake for All! Secure & Convenient Login for The New Enterprise for macOS®