Solved: User authentication via SSH using passwords on Sec... - Check Point CheckMates

User authentication via SSH using passwords on Security Gateways in AWS.

Hello, everyone.

One of our clients has just deployed a cluster in the AWS cloud with R81.20 Take 105, which, as we recall, uses the Key Pair to authenticate via SSH.

However, since the client belongs to financial institutions and has robust security policies, it is not possible for them to share the Key Pair with multiple users. In this regard, we would like to ask the following:

Is it possible to create local users with passwords to manage the cluster and allow the admin user to continue authenticating with the Key Pair?

If this is not possible, have you tried any alternatives to prevent a user from using the same Key Pair to access with any user?

We look forward to your response.

Best regards.

Kudos

Click here to give kudos to this post.

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

2 Solutions

Accepted Solutions

PhoneBoy

Admin

‎2025-10-1701:41 PM

Show option menu

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Jump to solution

PasswordAuthentication is disabled by default for SSH on cloud instances.

This has to be disabled: https://support.checkpoint.com/results/sk/sk109587

View solution in original post

2\ \ \ Kudos

Click here to give kudos to this post.

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

(1)

Bob_Zimmerman

MVP Gold

‎2025-10-2008:32 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Jump to solution

Traditionally, you just stick a bunch of public keys in the shared user account's ~/.ssh/authorized_keys file. Any key there can authenticate as the user, so each admin has their own unique key.

If you do this, I would highly, highly recommend requiring users to put their unique username at the end of the line so as people resign, their key can be removed.

View solution in original post

Kudos

Click here to give kudos to this post.

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

(1)

5 Replies

PhoneBoy

Admin

‎2025-10-1701:41 PM

Jump to solution

PasswordAuthentication is disabled by default for SSH on cloud instances.

This has to be disabled: https://support.checkpoint.com/results/sk/sk109587

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

(1)

Jose_Luis_Hdz

Participant

‎2025-10-2008:21 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to PhoneBoy

Jump to solution

Hello Phoneboy.

My question is more about the implications of enabling SSH as an authentication method. That is, would doing this apply to all users in general, including the admin user? Or, alternatively, could the admin user keep the Key Pair as the authentication method and have local users authenticate via password?

Best regards.

Kudos

Click here to give kudos to this post.

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

PhoneBoy

Admin

‎2025-10-2101:21 PM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to Jose_Luis_Hdz

Jump to solution

You mean Password authentication?

This is a server-wide setting, which means users are ALLOWED to use password-based authentication.

SSH clients will always attempt key-based authentication first, which will be accepted if the key offered by the client matches an entry in ~/.ssh/authorized_keys (under user's home directory).

If the key offered isn't authorized, if PasswordAuthentication is set to yes, then the user will be permitted to enter a password for authentication.

Hope that makes it clear.

Kudos

Click here to give kudos to this post.

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0