1

Can VPN authentication details be re-used for SSH access?

Context: I'm looking into the feasability of having SSO to authenticate with a VPN and then be able to log into a server via SSH without having to re-supply credentials.

So rather than requiring separate keys/passwords for SSH, the credentials for authenticating with the VPN are used.

Assuming a user has authenticated to the VPN, can they perform an SSH login without having to re-authenticate (using the VPN authentication as SSO).

At this point, I'm assessing feasability, not whether it is recommended.

3

Without more detail about what solutions you are using, it will be hard to answer your question precisely, but generically yes you can do that. Usually your VPN server and your SSH server point to some external authentication directory and communicate with it over Radius so you can use the same one for both.

In most cases I've seen however, VPN authentication tends to be more strictly secured than for standard SSH access (though the latter often really would deserve more security), i.e. requiring some sort of two-factor auth, so although you may be using the same underlying credentials, you would still have a slightly different procedure for connecting, maybe concatenating the password with a token code of some sort.

EDIT: Added the comment details which mean this has been marked the (currently) accepted answer:

Ok I misunderstood the orignal question then. You might want to look at the possibilities with something like Kerberos. It is possible to use if for transparent SSH authentication (See here for example : blog.scottlowe.org/2006/08/21/…;. I honestly do not know if you can make that work seamlessly with your VPN authentication as well, it will probably depend on the products you use. Possibly with something like constrained delegation ?

3
  • Thanks. I realised the question was light on info, but at this point I'm just trying to work out what the correct question to ask is. :o)
    – Tim
    Jan 19 '16 at 7:36
  • I've clarified with a bit of extra detail. Specifically, I'm looking at how SSO can be used as VPN authentication and SSH. Would re-authentication still be required (not sure how a token would be passed round)? Any clarification pointing me to further reading would be sufficient to mark as the accepted answer. Thanks again.
    – Tim
    Jan 19 '16 at 7:45
  • 1
    Ok I misunderstood the orignal question then. You might want to look at the possibilities with something like Kerberos. It is possible to use if for transparent SSH authentication (See here for example : blog.scottlowe.org/2006/08/21/…>. I honestly do not know if you can make that work seamlessly with your VPN authentication as well, it will probably depend on the products you use. Possibly with something like constrained delegation ? Jan 19 '16 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.