# macOS logon

> Protect login, sudo and SSH on macOS with Ironchip using the PAM module: create an API Key application and edit the files in /etc/pam.d.

URL: https://docs.ironchip.com/en/identidad/integraciones/puestos/macos-logon/

This guide explains how to install the Ironchip Mac Logon service on a macOS device. It relies on a PAM module that adds a second factor to login, `sudo`, or SSH.

## Requirements

- Access to the Ironchip admin console.
- Administrator permissions on the device.
- The Ironchip PAM file, provided by the Ironchip team.

## Configure Ironchip

1. Sign in to the Ironchip admin console and create a new application of type **API Key**. Store the key in a safe place.

   [Image: Creating an API Key application in the console]

2. Add an access with the username of your Mac user.

   [Image: Access with the Mac username]

3. To find the exact username, open a terminal on the Mac and run `whoami`.

   [Image: Terminal showing the output of whoami]

## Configure macOS

:::caution[This can lock you out]
If you run this process incorrectly, it can permanently lock the system and its users. Keep a terminal with administrator permissions open throughout the process, and start by integrating the service only with `sudo` authentication, as a test, so you do not lose access to the system.
:::

1. Download the PAM file to your computer and copy it to `/opt/local/lib/pam`.

   ```bash
   cp <PAM file path> /opt/local/lib/pam
   ```

   If the folder does not exist, create it first.

   ```bash
   mkdir /opt/local/lib/pam
   ```

2. Go to `/etc/pam.d`. Depending on what you need to protect, add a line at the beginning of one of these files:

   | File                              | Protects                                                                         |
   | --------------------------------- | -------------------------------------------------------------------------------- |
   | `sudo`                            | Authentication when you run administrator actions, such as `sudo su` or similar. |
   | `authorization` and `screensaver` | Authentication when the user starts a session.                                   |
   | `sshd`                            | Authentication when you establish an SSH connection.                             |

   [Image: Files in the /etc/pam.d folder]

3. Edit one of those files and add the following line at the beginning, with the API key of your Ironchip application.

   ```text
   auth required /opt/local/lib/pam/pam_ironchip_auth.so host=https://api.ironchip.com api_key=<API_KEY>
   ```

4. Run this command to disable the unidentified-developer software protection for this file only. Otherwise, macOS does not allow the PAM file to run.

   ```bash
   xattr -dr com.apple.quarantine <PAM file path>
   ```

## Logs

To follow the Ironchip PAM module logs live, run this in a terminal:

```bash
log stream --predicate 'sender == "pam_ironchip_auth.so"' --level debug
```