topic Re: SSLVPN user can change password for first login in SASE and Remote Access

SSLVPN user can change password for first login

yeruel — Sat, 28 Dec 2024 07:50:48 GMT

Hi Checkmate,

I want to set up local users (SSLVPN users) for the VPN client. I set the same password for all local users (SSL VPN users) to log in to the Check Point endpoint mobile client, and then they have to change the password themselves. Is it possible for VPN client users to change the password at their first login to the client?

I expect to set their password at the first login into the client.

The users are not LDAP Users.

Re: SSLVPN user can change password for first login

the_rock — Sat, 28 Dec 2024 22:55:36 GMT

I believe there is an option for that when you create a user under auth tab? I can check in the lab Monday.

Andy

Re: SSLVPN user can change password for first login

yeruel — Mon, 30 Dec 2024 05:33:49 GMT

Hi Andy,

Waiting your LAB result. But I couldn't see in R81.20.

Re: SSLVPN user can change password for first login

AkosBakos — Mon, 30 Dec 2024 10:31:31 GMT

The option what Andy mentioned is available when I create an user on GAIA.

Re: SSLVPN user can change password for first login

the_rock — Mon, 30 Dec 2024 13:50:49 GMT

Thats right @AkosBakos

@yeruel Just tested in R81.20 and R82, such option does NOT exist for local vpn users. Is it possible, Im not sure, sorry : - (

Andy

Re: SSLVPN user can change password for first login

AkosBakos — Mon, 30 Dec 2024 13:53:48 GMT

My private opinion: avoid to use local users on the GW. I'm 100% percent sure, you have some kind of RADIUS, or something else for handling users. It would be much more safer...

Re: SSLVPN user can change password for first login

Lesley — Mon, 30 Dec 2024 18:41:37 GMT

We recommend not to use local accounts that authenticate the Remote Access VPN users with password-only authentication. This section provides mitigation steps to discover and prevent such accounts from logging into the VPN.

Read here for more info: https://support.checkpoint.com/results/sk/sk182336

Re: SSLVPN user can change password for first login

the_rock — Mon, 30 Dec 2024 18:43:16 GMT

Totally agree!

Re: SSLVPN user can change password for first login

yeruel — Tue, 31 Dec 2024 12:33:40 GMT

Hi @the_rock @Lesley @AkosBakos

I am going to use LDAP. Let me move the local users to Active directory and sync the AD with checkpoint. Therefore LDAP users can login using their LDAP username and password on vpn client. Is that right?

Re: SSLVPN user can change password for first login

the_rock — Tue, 31 Dec 2024 12:43:29 GMT

Thats the whole idea, correct. Just make sure its configured right and that branches can be fetched after.

Andy

https://support.checkpoint.com/results/sk/sk31841

If you follow above sk, it has to work 100%.