User authentication via SSH using passwords on Security Gateways in AWS.

[Jose_Luis_Hdz]

Hello, everyone.

One of our clients has just deployed a cluster in the AWS cloud with R81.20 Take 105, which, as we recall, uses the Key Pair to authenticate via SSH.

However, since the client belongs to financial institutions and has robust security policies, it is not possible for them to share the Key Pair with multiple users. In this regard, we would like to ask the following:

Is it possible to create local users with passwords to manage the cluster and allow the admin user to continue authenticating with the Key Pair?

If this is not possible, have you tried any alternatives to prevent a user from using the same Key Pair to access with any user?

We look forward to your response.

Best regards.

[PhoneBoy · Accepted solution]

PasswordAuthentication is disabled by default for SSH on cloud instances.
This has to be disabled: https://support.checkpoint.com/results/sk/sk109587 

[Jose_Luis_Hdz]

Hello Phoneboy.

My question is more about the implications of enabling SSH as an authentication method. That is, would doing this apply to all users in general, including the admin user? Or, alternatively, could the admin user keep the Key Pair as the authentication method and have local users authenticate via password?

Best regards.

[PhoneBoy]

You mean Password authentication?
This is a server-wide setting, which means users are ALLOWED to use password-based authentication.
SSH clients will always attempt key-based authentication first, which will be accepted if the key offered by the client matches an entry in ~/.ssh/authorized_keys (under user's home directory).
If the key offered isn't authorized, if PasswordAuthentication is set to yes, then the user will be permitted to enter a password for authentication.

Hope that makes it clear.

[the_rock]

Phoneboy is indeed correct.

[Bob_Zimmerman · Accepted solution]

Traditionally, you just stick a bunch of public keys in the shared user account's ~/.ssh/authorized_keys file. Any key there can authenticate as the user, so each admin has their own unique key.

If you do this, I would highly, highly recommend requiring users to put their unique username at the end of the line so as people resign, their key can be removed.