If you are a new user logging in for the first time, complete steps 1–3 to enable your RSA SecureID fob, set up a personal identification number (PIN) for it, and change your default NAS password.

If you are a current user and you just need to enable a new fob, complete steps 1 and 2.

Note: These steps apply only to the agency-wide RSA SecurID fobs that are provided by the NAS Division at NASA Ames Research Center. If your token was provided by another NASA center, please contact your local help desk for assistance. If you have a NAS-provided soft token (mobile app), see Enabling Your RSA SecurID Soft Token.

Step 1: Enable Your RSA SecurID Fob

Your SecurID fob was sent in a disabled state. To enable the fob, call the NAS Control Room at (800) 331-8737 or (650) 604-4444. NAS support staff will enable the fob remotely and set it to New PIN Mode. If you are a first-time user, a default NAS password will also be provided to you during the call.

Please note that NAS support staff will confirm your identity by asking you the security question you submitted with your account request form, or by calling you back at your phone number on record.

Step 2: Log into an SFE and Set Up an RSA SecurID PIN

Note: Your local system must be configured to log in using the Secure Shell (SSH) protocol. You will also need your enabled RSA SecurID fob.

1. On your local system, open a command-line interface terminal.
2. Use SSH to log into an SFE, as follows:

   your_local_system% ssh sfeX.nas.nasa.gov 

   where sfeX is sfe6, sfe7, or sfe8.

   Note: If you use different usernames on your local system and NAS systems, add your NAS username before specifying the SFE. For example:

   your_local_system% ssh zsmith@sfe6.nas.nasa.gov 

3. If you have a NASA personal identity verification (PIV) badge inserted into a reader attached to local host, you will be prompted for your PIV PIN. If you do not have a NASA PIV badge (or if it is not inserted in the reader), you will be prompted for your NAS password.
   
   If you are prompted for your NASA PIV PIN, the prompt will appear either in the terminal window or in a dialog box, depending how your local system is configured:
   • In the terminal window:

     Enter PIN for 'Key for PIV Authentication':

   • In a dialog box:
     
   
   If you are prompted for your NAS password, as shown below, type in the default NAS password you were provided:

   Password:
   

4. At the Enter PASSCODE prompt, shown below, type the six-digit tokencode that is displayed on your RSA SecurID fob.

   ----------------------------------------------------------------
   Enter PASSCODE:

5. Follow the instructions at the next prompt to create an RSA SecurID PIN, which must be exactly 8 alphanumeric characters including both letters and numbers (no special characters). Letters are not case-sensitive.

   ----------------------------------------------------------------
   To continue you must enter a new PIN. Are you ready to enter a new PIN? (y/n)
   
   Enter a new PIN of 8 alphanumeric characters:
   
   Re-enter new PIN to confirm: 
   
   New PIN accepted, press enter to continue.
   

   Note: Memorize your RSA SecurID PIN. Never write down your PIN.

6. Wait for the tokencode displayed on your fob to change. Then, enter your RSA SecurID PIN at the prompt, followed immediately by the tokencode. For example, if your PIN is "d701398z" and your fob displays the tokencode "052993," type d701398z052993 and press Enter:

   ----------------------------------------------------------------
   Wait for token to change, and enter PASSCODE: d701398z052993

   Together, your RSA SecurID PIN and your current tokencode comprise your RSA SecurID passcode.

   The new-PIN process is now complete, although you may not get clear confirmation on your screen. Currently, PINs do not expire, but this may change in the future.

Step 3: Log in Again and Change Your Default NAS Password

After you have completed the new-PIN process, the system will prompt you to log in again. If you are a new NAS user, you must complete these steps to change your default NAS password.

1. Log in as you did in Step 2.3, above. If you have a NASA personal identity verification (PIV) badge inserted into a reader attached to local host, you will be prompted for your PIV PIN. If you do not have a NASA PIV badge (or if it is not inserted in the reader), you will be prompted for your NAS password.

   Note: If you are prompted for your NASA PIV PIN, the prompt will appear either in the terminal window or in a dialog box, depending how your local system is configured. If you are prompted for your NAS password, you will see simply see Password: in the terminal window (as described in Step 2.3, above).

2. At the Enter PASSCODE prompt, enter your RSA SecurID passcode (your RSA SecurID PIN followed immediately by the tokencode displayed on your fob).

3. You will not be prompted to change your password until you log in to a front-end system. Log in to either a PFE or an LFE to trigger a password change:

   sfeX% ssh pfe

4. When prompted, enter your default NAS password, then create and confirm a new password. (See Password Creation Rules.)

You have now completed your first-time authentication to NAS systems using your NAS password or a NASA PIV badge and your RSA SecurID token. For information about subsequent logins, see Logging into NAS Systems.