Once you have your NAS password and RSA SecurID token enabled, you can use the RSA SecurID passcode + your NAS password to complete two-factor authentication to a NAS secure front-end system (SFE). In this case, connection from your local system to a system inside the enclave, such as a PFE or LFE, is done in two steps: first using SSH from your local system to one of the SFEs, and then using SSH again from the SFE to the system inside the enclave.

Step 1. Access the Secure Front Ends

To access one of the SFEs from your local system, run:

your_local_system% ssh username@sfeX.nas.nasa.gov 

where sfeX represents sfe[6-8] and username is your NAS username.

Notes:

• If you have any issues connecting to one of the four SFEs, try connecting to a different one.
• You can omit username@ in the command line if you have the same username for your local system and the NAS systems.

You will be connected to the SFE and prompted for your NAS password (sometimes referred to as your Lou or LDAP password) followed by a prompt for an RSA SecurID passcode. 

Step 2. Access Systems in the Enclave

To access a system inside the enclave (for example an LFE), from an SFE, run:

sfeX% ssh lfeX 

where sfeX represents sfe[6-8] and lfeX represents lfe[5-8].

You will be prompted for your RSA SecurID passcode.

Note: Password authentication from an SFE to a PFE or LFE is disabled per NAS security policy.

Moving from Password to Public Key

After you have mastered logging in to NAS systems using your RSA SecurID token and your NAS password, you have the option of setting up Public Key authentication and using RSA SecurID and public key to log in.