Two-Step Connection Using the NASA PIV Badge

Article ID: 663

Last updated: 23 Jul, 2026

If you have a NASA badge that is embedded with a personal identity verification (PIV) certificate, you can use your NASA PIV personal identification number (PIN) to access a NAS secure front-end system (SFE). In this case, connections from your local system to a system inside the enclave, such as a PFE or LFE, are done in two steps: first using SSH from your local system to one of the SFEs, and then using SSH again from the SFE to the system inside the enclave.

Step 1. Access a Secure Front End

Access one of the SFEs from your local system by running SSH as follows:

your_local_system% ssh username@sfeX.nas.nasa.gov

where sfeX represents sfe[6-8] and username is your NAS username.

Notes:

If you have any issues connecting to one of the four SFEs, try connecting to a different one.
You can omit username@ in the command line if you have the same username for your local system and the NAS systems.

You will be connected to the SFE and prompted for your NASA PIV PIN. Depending on how your local system is configured, the PIV PIN prompt may appear either in the terminal:

Enter PIN for 'Key for PIV Authentication':

or in a dialog box:

Step 2. Access Systems in the Enclave

Access a system inside the enclave (for example, an LFE) from the SFE by running SSH as follows:

sfeX% ssh lfeX

where sfeX represents sfe[6-8] and lfeX represents lfe[5-8].

You will be prompted for your NAS password (sometimes referred to as your Lou or LDAP password).

Moving from NASA PIV to Public Key

After you have mastered logging in to NAS systems using your NASA PIV PIN, you have the option of setting up public key authentication and using RSA SecurID and public key to log in.