11.3.2. Client-side authentication settings

For the client-side connection, PSM can authenticate the client inband (within the SSH protocol) using the following authentication methods:

Figure 11.6. SSH Control > Authentication Policies — Configuring SSH authentication policies

SSH Control > Authentication Policies — Configuring SSH authentication policies
  • LDAP: PSM will authenticate the client to the LDAP database set in the LDAP Server of the connection policy. To use LDAP authentication on the client side, select Client-side gateway authentication backend > LDAP, and select the permitted authentication methods (Password, Public key, X.509 certificate). More than one method can be permitted.

    Note
    • PSM will authenticate the client-side connection to the LDAP server configured in the connection policy. This is not necessarily the same as the LDAP server used to authenticate the users accessing the PSM web interface.

    • The public keys of the users stored in the LDAP database must be in OpenSSH format.

  • Local: Authenticate the client locally on the PSM gateway. For details, see Procedure 11.3.2.1, Local client-side authentication.

  • RADIUS: PSM will authenticate the client to the specified RADIUS server. Select Client-side gateway authentication backend > RADIUS, enter the IP address or hostname of the RADIUS server into the Address field, the port number of the RADIUS server into the Port field, and the shared secret of the RADIUS server into the Shared secret field. Only password-authentication is supported (including one-time passwords), challenge-response based authentication is not.

    To use the Password Authentication Protocol, select PAP. To use the Challenge-Handshake Authentication Protocol, select CHAP.

    Figure 11.7. SSH Control > Authentication Policies — Configuring RADIUS authentication

    SSH Control > Authentication Policies — Configuring RADIUS authentication

    Use an IPv4 address.

    To add more RADIUS servers, click and fill in the respective fields.

  • None: Do not perform client-side authentication, the client will authenticate only on the target server.

    Warning

    Hazard of security breach! If the None authentication option is selected on the client side and PSM is configured to use public-key or certificate based authentication on the server, the user will not be authenticated at all unless gateway authentication is required for the connection.

To use certificates to authenticate the client, you can use the LDAP and the Local backends. When using certificates to authenticate the client during inband gateway authentication, the success of the client-side inband gateway authentication depends on the client-side certificate, and whether the Trusted CA list is set in the SSH/Telnet Control > Authentication Policies > Client-side gateway authentication backend > X.509 certificate. This is summarized in the following table.

Trusted CA list is set in the Authentication Policy
YES NO
The certificate shown by the client is self-signed AND the user is in the Local User Database and has a self-signed certificate set in the database successful successful
The certificate shown by the client is CA-signed successful unsuccessful

Table 11.1. Client-side inband gateway authentication with different certificates