SSLVPN user can change password for first login

[yeruel]

Hi Checkmate,

I want to set up local users (SSLVPN users) for the VPN client. I set the same password for all local users (SSL VPN users) to log in to the Check Point endpoint mobile client, and then they have to change the password themselves. Is it possible for VPN client users to change the password at their first login to the client?

I expect to set their password at the first login into the client.

The users are not LDAP Users.

[the_rock]

I believe there is an option for that when you create a user under auth tab? I can check in the lab Monday.

Andy

[yeruel]

Hi Andy,

Waiting your LAB result. But I couldn't see in R81.20.

[AkosBakos]

The option what Andy mentioned is available when I create an user on GAIA.

[the_rock]

Thats right @AkosBakos 

@yeruel Just tested in R81.20 and R82, such option does NOT exist for local vpn users. Is it possible, Im not sure, sorry : - (

Andy

[AkosBakos]

My private opinion: avoid to use local users on the GW.  I'm 100% percent sure, you have some kind of RADIUS, or something else for handling users. It would be much more safer...

[Lesley]

We recommend not to use local accounts that authenticate the Remote Access VPN users with password-only authentication. This section provides mitigation steps to discover and prevent such accounts from logging into the VPN.

Read here for more info: https://support.checkpoint.com/results/sk/sk182336

[the_rock]

Totally agree!

[yeruel]

Hi @the_rock @Lesley @AkosBakos 

I am going to use LDAP. Let me move the local users to Active directory and sync the AD with checkpoint. Therefore LDAP users can login using their LDAP username and password on vpn client. Is that right?

[the_rock]

Thats the whole idea, correct. Just make sure its configured right and that branches can be fetched after.

Andy

https://support.checkpoint.com/results/sk/sk31841

If you follow above sk, it has to work 100%.