SPS as Gateway for Termius SSH connections

Hi Osman,

To prompt for gateway authentication when connecting to a target system via SSH thru SPS, you would need to create an SSH Authentication policy that has the following settings:

1. Create an LDAP Server policy as per steps here:

https://support.oneidentity.com/technical-documents/one-identity-safeguard-for-privileged-sessions/6.13.1/administration-guide/53#TOPIC-1789766

2. SSH Authentication Policy:

Under Gateway authentication method: select Password check box

Under Authentication Backend: select LDAP radio button

Authentication Policy Reference: https://support.oneidentity.com/technical-documents/one-identity-safeguard-for-privileged-sessions/6.13.1/administration-guide/70

3. SSH Connection policy:

In the SPS Initiated connection policy, select the LDAP Server policy created in step 1 and the authentication policy created in step 2

4. In the SSH client, you can use the syntax for username prompt as: gu=gwuser@remoteuser@target_server@SPS_IP

Reference: https://support.oneidentity.com/technical-documents/one-identity-safeguard-for-privileged-sessions/6.13.1/administration-guide/108#TOPIC-1790021

Thanks! 

Tawfiq.Ahmad Thanks Tawfiq for the detailed information. I started seeing gateway prompt after I disable default SSH connection. To enable both I've come across workaround to make second connection port to 24 instead of 22 and both are active at the same time. Any workaround to direct the traffic to second connection of both ports kept at 22?

Hi Osman,

The first connection policy that has a match will be the one used from top to bottom order if both have the same port.

Another workaround is you can switch the ports around to have the safeguard_default use the port 24 (that way sessions that are launched via SPP initiated will use that port automatically) and then use port 22 on SPS initiated so that you don't have to change the port on the client side manually? 

Thanks!

Hi Tawfiq , But in this case if I change for safeguard default to use 24 then any connection from SPP entitlements will use 24 for all backend assets right?

Hi Osman,

the backend assets will still use port 22 but here we would be changing how the client connects to SPS connection policy, for example:

SPP Initiated:
Launch session from SPP > SSH client will connect to SPS using connection policy (safeguard_default) on port 24 then SPS will connect to target asset using inband destination selection on port 22 which can remain the same.

SPS initiated:
SSH client will connect to SPS using connection policy (the second one) on port 22 then SPS will connect to target asset using inband destination selection on port 22 which can remain the same.

So for both connection policies the ( SPS > target backend assets) can remain as port 22 which is defined under Target > inband destination selection inside the connection policy but we are only changing it for the connection policy which only affects (Client > SPS) connections.

Thanks!

Hi Osman,

the backend assets will still use port 22 but here we would be changing how the client connects to SPS connection policy, for example:

SPP Initiated:
Launch session from SPP > SSH client will connect to SPS using connection policy (safeguard_default) on port 24 then SPS will connect to target asset using inband destination selection on port 22 which can remain the same.

SPS initiated:
SSH client will connect to SPS using connection policy (the second one) on port 22 then SPS will connect to target asset using inband destination selection on port 22 which can remain the same.

So for both connection policies the ( SPS > target backend assets) can remain as port 22 which is defined under Target > inband destination selection inside the connection policy but we are only changing it for the connection policy which only affects (Client > SPS) connections.

Thanks!