Authentication Methods

After the 1Kosmos PAM is installed and configured, users SSH into the Linux host and are presented with the available authentication methods based on the configured journey.

---

Push Notification

The push notification is sent to the 1Kosmos mobile app. The user must have their account enrolled and the app installed.

Number Challenge (available from v1.09.08) adds an extra layer of security against push bombing. When enabled, a number is displayed on the SSH login screen and the user must tap the matching number in the app instead of simply approving.

To enable number challenge, turn on Enable number challenge on all push notification requests under Authentication > Passwordless Login > Passwordless Login using 1Kosmos App in AdminX. Requires Linux SSH MFA v1.09.08 or later.

Behavior	Number Challenge Enabled	Number Challenge Disabled
SSH screen	Shows a number to match	Standard push prompt
Mobile screen	Shows three number options to select from	Shows "Yes, it's me" consent screen
User action	Tap the correct number; wrong number cancels auth	Tap "Yes, it's me" to approve

OTP (App-Based)

SSH into the host, then open the 1Kosmos mobile app and note the six-digit Workstation OTP (swipe left if not visible). Enter the OTP at the prompt and press Enter.

QR Code

SSH into the host and select the QR option from the authentication menu. Scan the QR code using the 1Kosmos mobile app, approve the request, then press Enter to complete login.

Password + OTP + Push Notification

This is a three-factor flow:

1. SSH into the host and enter the six-digit OTP from the 1Kosmos app

2. On successful OTP validation, a push notification is sent to your enrolled device

3. Approve the push notification using your biometrics

4. Enter your 1Kosmos user password at the final prompt

Once all three factors are verified, you are logged in.