Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Mobile access VPN authentication question

Jump to solution

The client found SNX local user password complexity is low, but it seem that password length can set 8 characters at most. He want to know that is there exist increasing password length/complexity way? Can it be true? If no, 1. budget allow, which MFA way you recommend; 2. no budget, which MFA way you can suggest to increase secure for SNX? How to config?

0 Kudos
1 Solution

Accepted Solutions
Highlighted
Admin
Admin
For local passwords, there is no way to change/increase complexity requirements aside from using "OS Password" authentication: https://community.checkpoint.com/t5/General-Topics/Supporting-more-Complex-Passwords-without-using-a...
Then you can leverage Gaia's password length/complexity requirements.

External authentication servers would need to be leveraged for any sort of MFA.
One option is Google Authenticator, which can be set up with FreeRADIUS on any Linux server.
Here's a writeup on how to set that up: https://community.checkpoint.com/t5/General-Topics/MFA-with-Google-Authenticator/m-p/39456#M8416

Most of the other "paid" MFA options would also integrate via RADIUS.
Okta and Duo are two options I've seen write-ups on.

View solution in original post

0 Kudos
2 Replies
Highlighted
Admin
Admin
For local passwords, there is no way to change/increase complexity requirements aside from using "OS Password" authentication: https://community.checkpoint.com/t5/General-Topics/Supporting-more-Complex-Passwords-without-using-a...
Then you can leverage Gaia's password length/complexity requirements.

External authentication servers would need to be leveraged for any sort of MFA.
One option is Google Authenticator, which can be set up with FreeRADIUS on any Linux server.
Here's a writeup on how to set that up: https://community.checkpoint.com/t5/General-Topics/MFA-with-Google-Authenticator/m-p/39456#M8416

Most of the other "paid" MFA options would also integrate via RADIUS.
Okta and Duo are two options I've seen write-ups on.

View solution in original post

0 Kudos
Highlighted
Test successfully. Very nice.
0 Kudos