|Contents||Bulletin||Scripting in shell and Perl||Network troubleshooting||History||Humor|
|PAM (Pluggable authentication modules)||Linux PAM||Humor||Etc|
For Suse 10 SP1 64-bit you need version 6 of the RSA PAM agent. Please note that, as usual, RSA Installation guide is junk and you need to guess a lot of things to understand the technology. Thanks God the installation script is just a Borne shell script and reading it can clarify a lot of things
Here are the steps:
Create directory for temp storage of filecd
cd to it and Untar files
As of Jan 2010 the latest version is still AuthenticationAgent_60_PAM_95_060308.tar
Untar SecurID client into installation directory, created, for example, your home directory. For example
mkdir aceclient && cd aceclient
tar xvf ../AuthenticationAgent_60_PAM_95_060308.tar
1. Copy the file sdconf.rec from its usual location on the ACE/Server ( /ACE/data) to the SecurID client configuration directory (for example /var/ace). You can also copy it from any working client (usually at /var/ace)
# mkdir /var/ace
# cp ../sdconf.rec /var/ace
# ll /var/ace
-rw-r--r-- 1 root root 1024 Jan 25 11:10 sdconf.rec
2. Important: Verify that checksum is correct with the checksum on the server that works (that helps to detect accidental errors like transferring file in text mode, getting wrong file, etc. )
# cksum sdconf.rec
2006481408 1024 sdconf.rec
Note: The installation script assumes by default that the location of sdconf.rec. The default is recoded in the variable VAR_ACE. You can also change the default value in the installation script to, say, /etc/ace which probably would be more logical or /opt/ace:
if [ ! -n "$VAR_ACE" ]; then
1. Create target directory, for example /opt/ace.
2. Run install_pam.sh script and answer the question. Be careful when specifying target directory (no editing is available, you need to cancel the script is you made a typo).
# ARE YOU A CUSTOMER ORDERING THIS RSA PRODUCT FROM RSA SECURITY INC., FROM EITHER NORTH AMERICA, SOUTH AMERICA OR THE PEOPLE'S REPUBLIC OF CHINA (EXCLUDING HONG KONG): (y/n) [y]y LICENSE AGREEMENT ... ... ... Do you accept the License Terms and Conditions stated above? (Accept/Decline) [D]A Enter Directory where sdconf.rec is located [/var/ace] Please enter the root path for the RSA Authentication Agent for PAM directory [/opt] /opt/ace
Note: The script will also copy pam_securid.so to /lib64/security or /lib/security depending whether you are using 64-bit or 32-bit Linux The RSA Authentication Agent for PAM will be installed in the /opt/ace directory. pam/ pam/doc/ pam/lib/ pam/lib/pam_securid.so pam/bin/ pam/bin/acestatus pam/bin/acetest
Checking /etc/sd_pam.conf: VAR_ACE does not exist - entry will be appended ENABLE_GROUP_SUPPORT does not exist - entry will be appended INCL_EXCL_GROUPS does not exist - entry will be appended LIST_OF_GROUPS does not exist - entry will be appended PAM_IGNORE_SUPPORT does not exist - entry will be appended AUTH_CHALLENGE_USERNAME_STR does not exist - entry will be appended AUTH_CHALLENGE_RESERVE_REQUEST_STR does not exist - entry will be appended AUTH_CHALLENGE_PASSCODE_STR does not exist - entry will be appended AUTH_CHALLENGE_PASSWORD_STR does not exist - entry will be appended ************************************************************* * You have successfully installed RSA Authentication Agent 6.0 for PAM *************************************************************Note the last step is the creation of /etc/sd_pam.conf file
#VAR_ACE :: the location where the sdconf.rec, sdstatus.12 and securid files will go VAR_ACE=/var/ace #ENABLE_GROUP_SUPPORT :: 1 to enable; 0 to disable group support ENABLE_GROUP_SUPPORT=0 #INCL_EXCL_GROUPS :: 1 to always prompt the listed groups for securid authentication (include) # :: 0 to never prompt the listed groups for securid authentication (exclude) INCL_EXCL_GROUPS=0 #LIST_OF_GROUPS :: a list of groups to include or exclude...Example LIST_OF_GROUPS=other:wheel:eng:othergroupnames #PAM_IGNORE_SUPPORT :: 1 to return PAM_IGNORE if a user is not SecurID authenticated due to their group membership # :: 0 to UNIX authenticate a user that is not SecurID authenticated due to their group membership PAM_IGNORE_SUPPORT=0 #AUTH_CHALLENGE_USERNAME_STR :: prompt message to ask user for their username/login id AUTH_CHALLENGE_USERNAME_STR=Enter USERNAME : #AUTH_CHALLENGE_RESERVE_REQUEST_STR :: prompt message to ask administrator for their System password AUTH_CHALLENGE_RESERVE_REQUEST_STR=Please enter System Password for root : #AUTH_CHALLENGE_PASSCODE_STR :: prompt message to ask user for their Passcode AUTH_CHALLENGE_PASSCODE_STR=Enter PASSCODE : #AUTH_CHALLENGE_PASSWORD_STR :: prompt message to ask user for their Password AUTH_CHALLENGE_PASSWORD_STR=Enter your PASSWORD :
# ./acestatus RSA ACE/Server Limits --------------------- Configuration Version : 14 Client Retries : 5 Client Timeout : 5 DES Enabled : Yes RSA ACE/Static Information -------------------------- Service : securid Protocol : udp Port Number : 5500 RSA ACE/Dynamic Information --------------------------- Server Release : N/A Communication : 5 RSA ACE/Server List ------------------- Server Name : AUTHMGR Server Address : 10.201.144.100 Server Active Address : 0.0.0.0 Master : Yes Slave : No Primary : Yes Usage : Default Server during initial requests
Cannot communicate with the ACE/Server.
That the server specified in your sdconf.rec file is probably incorrent or down.
If you get prompt Enter USERNAME: then the server has been found sucessfully.
Unexpected error from ACE/Agent API.
Suse has a convoluted PAM setup, with the typical for Suse and other Linux distribution perversion of using to many files and too many includes. So modifying it for SecureID is far from being a straightforward exersize.
In the typical installation you usually want to use SecurID for all daemons except SSH (where certificates provide same level of security without paying exorbitant amount of money to RSA ;-)
There are many ways to achieve that. The one that we recommend is to modify login by commenting out three lines which are show below in green and adding the line auth required pam_securid.so at the top:
auth required pam_securid.so
#auth required pam_securetty.so
#auth include common-auth
#auth required pam_nologin.so
account include common-account # this is just account required pam_unix2.so
password include common-password
session include common-session
session required pam_lastlog.so nowtmp
session required pam_resmgr.so
session optional pam_mail.so standard
If you in addition comment out common-password or make
you will lose ability to use regular passwords which is useful for selected group of users (usually
Note 1: commented out "include" common-auth contains just two lines
auth required pam_env.so
auth required pam_unix2.so
Note 2: include common-password also contains two lines (plus one commented out line):
password required pam_pwcheck.so nullok password required pam_unix2.so nullok use_authtok #password required pam_make.so /var/yp
Preserving it allow to use regular passwords for selected users or groups (Group wheel) by additing pam_require module. See Wheel Group for details.
You also need to modify pure-ftp.pam as it does not use login. Add "auth required pam_securid.so" at the top and comment out "include common-auth"
auth required pam_securid.so
auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
#auth include common-auth
auth required pam_shells.so
account include common-account
password include common-password
Note: here are RSA recommendations from the installation manual (which is very weak).
SUSE Linux Enterprise Server 9 (SP3) and 10 (64 bit):
1. Change to /etc/pam.d/ and open the login file.auth required pam_securetty.so auth include common-auth auth required pam_nologin.so account include common-account password include common-password session include common-session session required pam_lastlog.so nowtmp session required pam_resmgr.so session optional pam_mail.so standard session required pam_limits.so # added by orarun2. Comment out the following 3 lines:auth required pam_securetty.so auth include common-auth auth required pam_nologin.so3. Replace them with the following lines:auth required pam_securid.so auth required pam_ldap.so
|Bulletin||Latest||Past week||Past month||
On Sun, Jan 20, 2002 at 04:37:19PM -0500, Sam Hartman wrote: > I've gotten several Debian bug reports that pam_nologin should be an > account module so it works better with ssh. The problem is that if > you have RSA auth or Kerberos auth with ssh, the pam_authenticate call > is is skipped, so if pam_nologin is in the auth stack, then it will be > ignored. > Clearly making pam_nologin be an account module is wrong because doing > so would cause it to wait until after the password is entered for > login applications. What about allowing pam_nologin to be both an > account and auth module? Would this be acceptable? I've commented before that many of the modules that ship as auth-only would also be very useful as account modules; I never heard any objections to that idea, it just seemed to be a question of writing the code. Steve Langasek postmodern programmer
Hello all, I am currently using pam_securid to authenticate users using RSA's securid keychain fobs. I have a problem: If a user has anything in their password field in /etc/shadow, the authentication fails. I would like to have password fields in /etc/shadow with legitimate passwords otherwise I get unwanted side-effects like users being able to 'su' to any other user with no password. Currently, this is my /etc/pam.d/sshd file (ssh is the only way to login to this machine) #%PAM-1.0 auth required /lib/security/pam_securid.so auth required /lib/security/pam_env.so auth sufficient /lib/security/pam_unix.so likeauth nullok auth required /lib/security/pam_deny.so auth required /lib/security/pam_nologin.so account required /lib/security/pam_unix.so password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so I would like to know what to take out of /etc/pam.d/sshd, system-auth or su in order for me to authenticate with pam_securid (the only method I want users to authenticate with), yet still have passwords in the /etc/shadow file to prevent users from su-ing, etc. Thanks for your help --Eric
Roger E McClurg wrote:I'm using the RSA PAM SecurID module (5.0). It authenticates users just fine, but when a token gets into new pin mode or next token mode the user does not get the prompts just a NAK. Does anyone have any experience with this?
radius auth required /usr/lib/security/$ISA/pam_securid.so debug
radius account required /usr/lib/security/$ISA/pam_securid.so debug
radius password required /usr/lib/security/$ISA/pam_sample.so.1
I've never used pam_securid, but should this not point to pam_securid too? It "new pin" or "next token" modes sound like they would map onto pam_chauthtok, which is what this is.
radius session required /usr/lib/security/$ISA/pam_sample.so.1-- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement.
auth required pam_securid.so
#auth required pam_unix2.so # set_secrpc
auth required pam_nologin.so
auth required pam_env.so
account required pam_unix2.so
account required pam_nologin.so
password required pam_pwcheck.so
password required pam_unix2.so use_first_pass use_authtok
session required pam_unix2.so none # trace or debug
session required pam_limits.so
# Enable the following line to get resmgr support for
# ssh sessions (see /usr/share/doc/packages/resmgr/README.SuSE)
#session optional pam_resmgr.so fake_ttyname
RSA Secured Partner Solutions for RSA SecurID
Configuring SecurID Authentication
Installation and Configuration Guide
By leveraging the strength of RSA SecurID® and the flexibility of PAM, organizations can eliminate security risks associated with using static passwords for user authentication. While enhancing security, the RSA SecurID solution can help organizations reduce Help desk costs from password-related calls and increase user productivity.
Supported Platforms Platform set I:
Platform set II:
- Red HatTM Enterprise Linux® AS/ES/WS 4.0 on 64-bit (Intel® Xeon and AMD Opteron)
- HP-UX 11.00, 11i (PA-RISC 2.x)
- Sun® SolarisTM 10 x86 on 32-bit (Intel®)
Platform set III:
- Sun® SolarisTM 10 x86 on 64-bit (Intel® Xeon and AMD Opteron)
- Sun® SolarisTM 10 on 64-bit (UltraSPARC)
- HP-UX 11iv2 (Itanium®)
- AIX® 5L 5.3 with TL5 (SP6) 64-bit (RISC/6000® PowerPC®)
- SUSE Linux Enterprise Server 9 (SP3) on 64-bit (Intel® Xeon, AMD Opteron)
- SUSE Linux Enterprise Server 10 on 64-bit (Intel® Xeon, AMD Opteron)
(Other platforms will be released later)
RSA strongly recommends using OpenSSH.
PAM Agent for platform set I was qualified with OpenSSH 4.3p2.
PAM Agents for platform sets II and III were qualified with OpenSSH 4.5p1.
7 MB free disk space
RSA ACE/Server 5.2, RSA Authentication Manager 6.0, or RSA Authentication Manager 6.1 or later
Pricing and Availability
Download this agent for free RSA Authentication Agent 6.0 for PAM
RSA Authentication Agent 5.3.4 for PAM
Supported Platforms RSA Authentication Agent 5.3.4 for PAM supports only the 32-bit version of the following operating systems:
- Sun® SolarisTM 8, 9 and 10
- Red HatTM Enterprise Linux® AS/ES 3.0 and 4.0
- SUSE Linux Enterprise Server 9
- AIX® 5L v5.3 with ML2, ML3, TL4
- HP-UX 11i
The PAM Agent supports OpenSSH 4.1p1 for all platforms and OpenSSH 4.3p1 on Red Hat Enterprise Linux AS/ES 4.0. RSA strongly recommends using OpenSSH.
Other Requirements 6 MB free disk space
RSA ACE/Server 5.1 or later, or RSA Authentication Manager 6.0 or later
Pricing and Availability Download this agent for free
RSA Authentication Agent 5.3.4 for PAM
Groupthink : Understanding Micromanagers and Control Freaks : Toxic Managers : Bureaucracies : Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Two Party System as Polyarchy : Neoliberalism : The Iron Law of Oligarchy : Libertarian Philosophy
Skeptical Finance : John Kenneth Galbraith : Keynes : George Carlin : Skeptics : Propaganda : SE quotes : Language Design and Programming Quotes : Random IT-related quotes : Oscar Wilde : Talleyrand : Somerset Maugham : War and Peace : Marcus Aurelius : Eric Hoffer : Kurt Vonnegut : Otto Von Bismarck : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce : Oscar Wilde : Bernard Shaw : Mark Twain Quotes
Vol 26, No.1 (January, 2013) Object-Oriented Cult : Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks: The efficient markets hypothesis : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Vol 23, No.10 (October, 2011) An observation about corporate security departments : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law
Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds : Larry Wall : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS : Programming Languages History : PL/1 : Simula 67 : C : History of GCC development : Scripting Languages : Perl history : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history
The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month : How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite
Most popular humor pages:
Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor
The Last but not Least
You can use PayPal to make a contribution, supporting hosting of this site with different providers to distribute and speed up access. Currently there are two functional mirrors: softpanorama.info (the fastest) and softpanorama.net.
The statements, views and opinions presented on this web page are those of the author and are not endorsed by, nor do they necessarily reflect, the opinions of the author present and former employers, SDNP or any other organization the author may be associated with. We do not warrant the correctness of the information provided or its fitness for any purpose.
Last modified: July 18, 2014