Installation

This section covers installing the 1Kosmos Linux PAM package, configuring the required license and PAM files, setting up sshd, and verifying the setup with a test SSH login.

---

Installing the PAM Package

RHEL

# Install prerequisites
sudo yum install -y tar libuuid vim-common libcurl

# Install 1Kosmos PAM
sudo ./blockId.<version>.<timestamp>.sh

Ubuntu

# Install prerequisites
sudo apt install uuid-runtime libcurl4

# Install 1Kosmos PAM
sudo ./blockId.<version>.<timestamp>.sh

---

Configuring the License File

After installation, update the license_config file at /opt/BlockId/data/license_config with your tenant details. Only a root user can modify this file. Use a text editor such as vi to set the following parameters:

TENANT_DNS=yourtenant.1kosmos.net
COMMUNITY=yourcommunity

---

Configuring PAM Files

Keep an additional root shell open before making any changes to PAM or sshd configuration to avoid locking yourself out. Back up all files before modifying them, and verify PAM configuration works locally before testing over SSH.

RHEL — password-auth

Update /etc/pam.d/password-auth to ensure 1Kosmos 2FA is not bypassed:

• Do not have any auth rule with a control flag set to sufficient or [...success=done...] — these will bypass all subsequent PAM rules including 1Kosmos

• Replace any such rules with [success=X default=ignore], where X is the number of auth rules below the current one in the file

• Ensure the last auth rule (pam_deny.so) has its control flag set to requisite

Example: If auth sufficient pam_sss.so forward_pass has three auth rules below it, update it to:

auth   [success=3 default=ignore]   pam_sss.so forward_pass

If the last rule appears as auth required pam_deny.so, update it to:

auth   requisite   pam_deny.so

password-auth — before modification:

password-auth — after modification:

RHEL — sshd

Update /etc/pam.d/sshd:

• Add the pam_blockId.so rule immediately after the primary authentication (typically password-auth) with control flag set to requisite

• Ensure no preceding PAM rules use sufficient or success=done

• If a substack entry exists before pam_blockId.so, change it to include and ensure it does not contain any sufficient or success=done rules

sshd — before modification:

sshd — after modification:

Ubuntu — sshd

Update /etc/pam.d/sshd:

• Add the pam_blockId.so rule after the primary authentication (common-auth) with control flag set to requisite

sshd — before modification:

sshd — after modification:

---

Configuring sshd_config

Add the following flags to /etc/ssh/sshd_config:

Flag	Value	Description
ChallengeResponseAuthentication	yes	Enables keyboard-interactive authentication
KbdInteractiveAuthentication	yes	Deprecated alias for ChallengeResponseAuthentication
UsePAM	yes	Enables the PAM interface
MaxAuthTries	1	Maximum authentication attempts per connection
PubkeyAuthentication	no	Disables public key auth to prevent bypassing 1Kosmos MFA

If /etc/ssh/sshd_config.d/50-redhat.conf exists, comment out the ChallengeResponseAuthentication no line.

Note: Restart sshd after any changes: service sshd restart

---

Configuring SELinux (RHEL Only)

If SELinux is enabled on the host, additional permissions are required for the 1Kosmos PAM to function.

1. Verify SELinux status: sestatus

2. Set SELinux to permissive mode: setenforce 0

3. Install policycoreutils:

sudo yum -y install policycoreutils-python
# If not found:
sudo yum -y install policycoreutils-python-utils

1. Open a new terminal and SSH into the host — this generates the audit logs needed in the next step

2. Create a semodule from the audit logs:

sudo ausearch -c 'sshd' --raw | audit2allow -M BlockIDPAM

This creates two files: BlockIDPAM.te and BlockIDPAM.pp

1. Install the semodule:

sudo semodule -i BlockIDPAM.pp

1. Re-enable enforcing mode: setenforce 1

---

Testing the Setup

SSH into the configured Linux host:

ssh <username>@<ip address>

After entering the correct password, the 1Kosmos 2FA login menu appears. The options displayed depend on the authentication methods configured for the Linux CP application in AdminX.