4

I have a single CentOS server, and several Windows clients that should connect to it, from remote. I've successfully setup OpenVPN (with Public Keys), with which the clients connect to the server; and then they use SSH to do the actual work. Everything is working fine in this configuration.

However, there is some redundancy here - after the user authenticated with the OpenVPN key, he must manually login to the SSH and supply the password.

Is it possible, that the SSH server will 'understand' that the user has already authenticated?

I have tried to go in the lead of setting LDAP server, use it for the Unix accounts managements, and then use it for OpenVPN authentication - but it was too complicated, and I'm not sure that it's worth the effort for such a small configuration.

1 Answer 1

2

Is it possible, that the SSH server will 'understand' that the user has already authenticated?

No.

Just implement key auth for SSH as well. Then your users can ssh into your servers without typing a password at all (save for the initial private key load into your ssh key agent). You really should be using key authentication anyway. Doing this is a win/win for you.

4
  • OK... Can I reuse the OpenVPN keys, or should I create a new set for SSH?
    – Zvika
    May 4, 2015 at 18:58
  • You shouldn't be creating keys at all...your users should be creating their own keypairs and then giving you their public keys to deploy. I don't believe it's possible to share keys between OpenVPN and OpenSSH.
    – EEAA
    May 4, 2015 at 18:59
  • Both OpenVPN and SSH can use RSA keys. You can use the same private key for both. Generating the public SSH key, and the generating a cert for OpenVPN are different processes. Using the same for both is not trivial though. You are probably better off just keeping them separate.
    – Zoredache
    May 4, 2015 at 19:25
  • Zoredache, technically yes, but SSH keys must be installed separately on client and on server, so there key reuse generally meaningless.
    – mmv-ru
    May 4, 2015 at 19:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .