SecureID RSA Authentication on Linux

How to Install SecureID RSA authentication.

What is RSA?

Thanks for stopping by turbogeek.co.uk, be sure to check out my other content by clicking here.

SecureID RSA Authentication access is essential in any IT deployment these days, RSA creates an additional layer of protection to your server infrastructure by adding multi-factor authentication. This guide focuses on RSA SSO (Single-Sign-On). To make a successful installation, you require 2 RSA appliances, preferably virtualized for added durability. Each of your servers will need to have the RSA Agent installed and configured to interact with your Appliance.

With a strong RSA authentication appliance, users can control their own access management using a mobile device or a downloaded RSA desktop application.

The RSA Secure ID access Agent is available for the following Operating Systems, Please note that Windows is supported, but I will be focusing on Linux only in this guide:

• Red Hat Enterprise Linux (RHEL) RHEL 6.8 – 6.10 (32-bit and 64-bit)
• RHEL 7.1 – 7.5 (64-bit)
• CentOS CentOS 7.5 (64-bit)
• Oracle Linux Oracle Linux 6.8 – 6.10 (64-bit)
• Oracle Linux 7.3 – 7.5 (64-bit)
• SUSE Enterprise Linux SUSE Enterprise Linux Server version 11 SP3 – SP4 (32-bit and 64-bit)
• SUSE Enterprise Linux Server version 12 – 12 SP3 (64-bit)
• SUSE Linux Enterprise Server 15 (64-bit)
• Solaris Solaris SPARC 10 (32-bit and 64-bit). RSA recommends Update 8 or later.
• Solaris SPARC 10.5 (32-bit and 64-bit) with Zones
• Solaris SPARC 11.2 (32-bit and 64-bit)
• Solaris x86 10.5 Update 11 (32-bit)
• Solaris x86 11.2 (32-bit)
• AIX AIX 7.1 TL3 (SP5) Power 6 (32-bit and 64-bit)
• AIX 7.2 TL1 (SP2) Power 8 (32-bit and 64-bit)

How to install RSA SSO Agent on Linux Distributions

Please note : This process has been installed and tested on RedHat 6.9 (Santiago), RedHat 7.3 (Maipo) and CentOS 7.4.
This service allows for two-factor authentication using an RSA passcode and user password.

Step 1 – Installation Prerequisites:

Please take some time to read and understand the prerequisites of the RSA agent installation:

• The User must have an account on the Linux Server
• After Installation, changes must be made to the following files (outlined later), access via root or sudo privileged user:

/etc/ssh/sshd_config
/etc/pam.d/sshd
/etc/sd_pam.conf

Step 2 – Configure the RSA SecureID Authentication Server

Log onto your RSA Appliance server and complete the following tasks:

• The LINUX server IP address MUST be manually added to the RSA Authentication server.
  (In the security console, click Access > Authentication Agents > Add New)

• A copy of the RSA Authentication Manager certificate is required.
  (In the security console, click Access > Authentication Agents > Download Server Certificate File)

• Generated Configuration File (AM_Config.zip) from the RSA Security Console.
  (In the security console, click Access > Authentication Agents > Generate Configuration File)

Please Note – To speed up the process I recommend unzipping the AM_Config.zip that is downloaded as part of the above tasks, do this before you transfer to the server

Step 3 – Transfer the Installation files and config to the Linux Server

Transfer your files to the Linux server. You may wish to do this using SCP or some form of FTP client, such as FileZilla or WinSCP. If you are using macOS, I recommend The Unarchiver

RSA PAM package (PAM-Agent_v8.0.0.195.11_23_17_04_55_23.tar)
(https://community.rsa.com/community/products/securid/authentication-agent-pam)

Step 4 – Prepare the Linux Server

Log onto the Linux server using SSH. Preferably with a sudo root account

Create /var/ace directory on the server host

mkdir /var/ace

Create the Authentication Manager configuration file, sdopts.rec

touch /var/ace/sdopts.rec

Add the server host IP address to the sdopts.rec

sudo vim /var/ace/sdopts.rec

The sdopts.rec file only needs one line

CLIENT_IP=x.x.x.x

where IP is the IP of the host machine

Copy the server.cer and sdconf.rec files to /var/ace folder

sudo cp server.cer sdconf.rec /var/ace

Install two packages to the server to ensure the RSA PAM package will work.

sudo yum install selinux-policy-devel

sudo yum install policycoreutils-python  

Please note – the second package (policycoreutils-python) should be installed as part of the install process of the first package.  This can be verified during the install process of the selinux-policy-devel package.

Step 5 – Install the PAM Authentication Agent

To Install Pam RSA Agent V8.0 or greater, browse to the downloaded path you set in Step 3 (for example,/tmp/)

Extract the PAM Agent tar file

tar xvf PAM-Agent_v8.0.0.195.11_23_17_04_55_23.tar

Navigate to the newly created folder and install the agent

For Example:

cd PAM-Agent_v8.0.0.195.11_23_17_04_55_23
sudo sh ./install_pam.sh

You will now be asked to accept a license agreement.  Scroll to the end of the agreement (space bar).  Type A to accept. Press RETURN.  During the installation, you will be asked a series of questions regarding the install path, authentication mode and

1. Select which operation mode you would like to configure for authentication [0/1/2] :
   Choose option 0 (RSA Authentication Manager with the UDP Protocol)
2. Enter Directory where sdconf.rec is located [/var/ace] :
   <RETURN> (the sdconf.rec file should be located in the /var/ace folder from previous step)
3. Please enter the root path for the RSA Authentication Agent for PAM directory [/opt] :
   <RETURN>

Once successful, the install will output the following:

 pam/
 pam/conf/
 pam/conf/mfa_api_template.properties
 pam/conf/log.properties
 pam/lib/
 pam/lib/32bit/
 pam/lib/32bit/libpamrest32.so
 pam/lib/32bit/liblog4cxx.so.10.0.0
 pam/lib/32bit/pam_securid.so
 pam/lib/64bit/
 pam/lib/64bit/liblog4cxx.so.10.0.0
 pam/lib/64bit/libpamrest.so
 pam/lib/64bit/pam_securid.so
 pam/bin/
 pam/bin/32bit/
 pam/bin/32bit/acetest
 pam/bin/32bit/ns_conv_util
 pam/bin/32bit/acestatus
 pam/bin/64bit/
 pam/bin/64bit/acetest
 pam/bin/64bit/ns_conv_util
 pam/bin/64bit/acestatus

Checking /etc/sd_pam.conf:
VAR_ACE does not exist - entry will be appended
OPERATION_MODE does not exist - entry will be appended
RSATRACELEVEL does not exist - entry will be appended
RSATRACEDEST does not exist - entry will be appended
ENABLE_USERS_SUPPORT does not exist - entry will be appended
INCL_EXCL_USERS does not exist - entry will be appended
LIST_OF_USERS does not exist - entry will be appended
PAM_IGNORE_SUPPORT_FOR_USERS does not exist - entry will be appended
ENABLE_GROUP_SUPPORT does not exist - entry will be appended
INCL_EXCL_GROUPS does not exist - entry will be appended
LIST_OF_GROUPS does not exist - entry will be appended
PAM_IGNORE_SUPPORT does not exist - entry will be appended
AUTH_CHALLENGE_USERNAME_STR does not exist - entry will be appended
AUTH_CHALLENGE_RESERVE_REQUEST_STR does not exist - entry will be appended
AUTH_CHALLENGE_PASSCODE_STR does not exist - entry will be appended
AUTH_CHALLENGE_PASSWORD_STR does not exist - entry will be appended
BACKOFF_TIME_FOR_RSA_EXCLUDED_UNIX_USERS does not exist - entry will be appended
Checking /var/ace/conf/mfa_api.properties:
REST_URL does not exist - entry will be appended
CLIENT_KEY does not exist - entry will be appended
CA_CERT_FILE_PATH does not exist - entry will be appended
CLIENT_ID does not exist - entry will be appended
CONNECT_TIMEOUT does not exist - entry will be appended
READ_TIMEOUT does not exist - entry will be appended
MAX_RETRIES does not exist - entry will be appended

*****************************************************************************
* You have successfully installed RSA Authentication Agent 8.0.0 [195] for PAM
*****************************************************************************

Please note:  If SELinux is enabled, the output may include SELinux-related information.

Step 6 – Configure PAM

Change /etc/pam.d/sshd

vi /etc/pam.d/sshd

Add the following lines to the sshd

Bash

 auth      required              pam_securid.so 
 auth      required              pam_unix.so

 Using # rem out other auth required lines (for example)

Bash

auth                  required              pam_sepermit.so

Change the sshd_config file

vi /etc/ssh/sshd_config

Set the following parameters and save the changes:

PasswordAuthentication no
ChallengeResponseAuthentication yes
UsePAM yes
UsePrivilegeSeparation no
**Please note: This file may look different with each version of Linux and also whether SELINUX is enabled **

Change the /etc/sd_pam.conf file

vi /etc/sd_pam.conf

Bash

ENABLE_USERS_SUPPORT=1
LIST_OF_USERS=root
PAM_IGNORE_SUPPORT_FOR_USERS=1
PAM_IGNORE_SUPPORT=1

Once you modified the above files restart the SSHD service

IMPORTANT NOTICE:

DO NOT close the terminal / SSH window!  If there is a misconfiguration you could potentially lock yourself out of the system altogether**

To restart the service in Red Hat 6

service sshd restart 

To restart the service in Red Hat 7

sudo systemctl restart sshd.service

Step 8 – Testing

During the installation, the PAM installer will add the following scripts to /opt/pam/bin/64bit:

./acestatus
./acetest
./ns_conv_util

To test the RSA Authentication module, type:

./acetest

You should be presented with:

Enter USERNAME:
(E.G Joe.Bloggs)

Enter PASSCODE:
(using your RSA soft token enter your PIN and generated CODE)

If all of the details are entered correctly, you should receive the following message.

Authentication Successful.

Step 9 – Live Tests

Once you have achieved a successful test status, open up a new SSH session to test the two-factor authentication.  During this phase, you should be asked to enter your:

USERNAME: PASSCODE : PASSWORD

You should now have gained access to the required server.

Troubleshooting:

If your testing was unsuccessful, please check the following logs

Cat or tail /var/log/secure to view the RSA logs

tail –f /var/log/secure

Review the entries within the log to ensure the details you enter are correct.

If your “live” login fails, the logs within the RSA Security Console can be reviewed using the Authentication Monitor.

Adding Exceptions:

There are many circumstances where you will need to give a user account an exception, such as the root account, a backup service or any other system service that needs sudo root access.

Note the entry within the /etc/sd_pam.conf file

vim /etc/sd_pam.conf

Look for the line

LIST_OF_USERS=root

This section allows you to enter system users that shouldn’t require two-factor authentication.  The above example shows the root user.  This is list can contain as many users as necessary

Important: Users must be separated by a colon :

For Example:

LIST_OF_USERS=root:nagios:contabuser

Certain system functions may require access to the root user (RSYNC for example), it would be beneficial to exclude this user.

That’s it, thanks for taking the time to read this article. if you have any questions or feedback please write in the comment section below.