• Add the Unix password as an extra layer of security along with the passcode (PIN + tokencode); or
• Enable some users to login with their passwords only without the passcode. 

• Configure the pam.d config file that corresponds to the service for which you want to configure SecurID access (e.g., sshd, su, sudo).
• Configure the SecurID PAM module configuration file (sd_pam.conf). 
• This article assumes that the basic configuration steps were made for the specific module that are included in the RSA SecurID Authentication Agent 8.1 for PAM.
• In this article we review editing the SSH service as an example.

Scenario 1

1. Login to the server on which the RSA Authentication Agent for PAM is installed.
2. Change to root:

sudo su - root

3. Navigate to /etc/pam.d:

cd /etc/pam.d

4. Make a copy of the sshd file:

cp ./sshd > ./sshd.rsabackup

6. Using a text editor, edit /etc/pam.d/sshd:

vim /etc/pam.d/sshd

7. Modify the file so the pam_securid.so and pam_unix.so values are as follows: 

auth    required        pam_securid.so
auth    required        pam_unix.so

8. Edit the sd_pam.conf to ignore users that are not in the SecurID challenge group:
   1. Login to the server on which the PAM agent is installed.
   2. Change to root:

su - root

3. Navigate to /etc:

cd /etc

4. Take a backup of the sd_pam.conf file.

cp ./sd_pam.conf > ./sd_pam.conf.rsabackup

9. Edit the sd_pam.conf:

vim /etc/sd_pam.conf

10. Here is where you configure to ignore users who are not challenged by SecurID; meaning if, from this same file, you excluded users or groups from SecurID authentication, then the SecurID PAM module will be transparent to them, and from the configuration in the previous file we see it will jump directly to the Unix system password challenge only.  To do this, add the following entries to the file with a value of 1 to ignore users and groups:

PAM_IGNORE_SUPPORT_FOR_USERS=1
PAM_IGNORE_SUPPORT=1

sudo su - root

cd /etc/pam.d

cp ./sshd > ./sshd.rsabackup

vim /etc/pam.d/sshd

auth    required        pam_securid.so

cd /etc
cp ./sd_pam.conf > ./sd_pam.conf.rsabackup

vim /etc/sd_pam.conf

INCL_EXCL_USERS=1
LIST_OF_USERS=<someUser>
PAM_IGNORE_SUPPORT_FOR_USERS=0

PAM_IGNORE_SUPPORT_FOR_USERS=0

Notes for Scenario 1

• The entry for pam_unix.so performs authentication with the usual Unix password files, /etc/passwd and /etc/shadow. 
• For other flavors of Unix, the name of the pam_*.so file may change.  An internet search for <OS> system password pam module will list other versions.
• The required entry means that all required modules in a stack must pass for a successful result. If one or more of the required module fails, all of the required modules in the stack are implemented, but the first error is returned.
• The two lines of auth required pam_securid.so and auth required pam_unix.so will have a user authenticate with their SecurID passcode and then their Linux system password.