Skip to main content

Authenticate into an endpoint

Authenticating into an Endpoint​

Once an administrator has given you an account on an endpoint with an Endpoint Policy (see Giving a Person Access to an Endpoint User), you log in and approve the login with a push on your phone. You never need to know the account's password or key: AuthNull holds it.

The push comes from your organisation's MFA provider (AuthNull Authenticator, Duo Security or Okta Verify). If you use AuthNull Authenticator, your administrator registers your phone first (Users → row ⋯ → Register device) and you accept the invite in the app.

Logging in through a gateway​

  1. In the admin console, go to Switch product → PAM → Targets → Endpoints. The Connect button appears only on endpoints where a policy gives you an account.
  2. Click Connect, pick the Account, then either:
    • copy the Connection string and run it in your own terminal, or
    • choose Open terminal to work in the browser.
  3. Approve the push on your phone. The session opens. If the policy grants sudo, it applies for the policy's time limit.

The gateway fetches the account's key or password from the vault itself and records the session. If you deny the push, or do not answer it, the session is refused.

Logging in directly to an endpoint (1FA)​

On endpoints where the AuthNull PAM module is configured as the only factor, log in with SSH as usual. Instead of a password prompt, you receive a push. Approve it to log in, or deny it to reject the login.

Logging in directly to an endpoint (2FA with a password or SSH key)​

If the endpoint is configured for two factors, use your password or SSH key first, as you usually do. Then approve the push on your phone as the second factor, or deny it to reject the login.

See Local privilege 2FA with SSH Keys and Configure Local 2FA with Passwords.