Install and ConfigureAuthentication Service and RSA SecurID

The installation process for each agent does not interfere with or touch any configuration file used by the other product. Follow the standard installation steps for each product.

You can install the products in either order. After you install the Server Suite Agent, you need to join the computer to Active Directory and place it in a DirectControl Zone.

Installation Overview

To install and configure authentication service and RSA SecurID (an overview):

  1. Install the DirectControl agent for *NIX.

    For details, see the Server Suite documentation.

  2. Install and set up the RSA SecurID agent.

    For details, see the RSA document, “RSA Authentication Agent 7.1 for PAM--Installation and Configuration Guide for RHEL.” The document is included in the agent download package.

  3. Run the RSA acetest command to verify that the user login credentials work.

    For details, see the RSA documentation.

  4. If you have configured role definitions or command rights to require multi-factor authentication (MFA), you create a symlink to point to the RSA SecurID authentication file instead of the file for DirectControl. For details, see Configuring SecurID for use with Server Suite zone-based role and privilege execution.

    With MFA enabled for role definitions or command right definitions, you don’t have to manually configure each authentication module to use RSA SecurID.

  5. If you use Authentication Service but you don’t use role definitions or command right definitions configured for MFA:

    1. Modify the PAM authentication files for Linux, Solaris, or AIX:

      1. For Linux: Configure the /etc/pam.d/system-auth file:

        For details, see Configure the /etc/pam.d/system-auth File for Linux.

      2. For Solaris and AIX: Configure the pam.conf file:

        For details, see Configure the pam.conf File for Solaris and AIX.

    2. (Optional) Configure the system to use the SecurID for authentication for specific users or groups.

      It may be a good idea to disable SecurID authentication for the root user, at least initially, so that you don’t get locked out of the computer entirely.

    3. (Optional, as needed) Configure SSH or other authentication services to use SecurID. For details on configuring SSH, see Configuring the pam.conf file for Solaris and AIX.