Public Key
Public key authentication is one of the most secure methods of authentication, because the authentication information can be stored on a
removable medium such as a USB key device. You can generate the key files for every user, or you can reset the public keys for everyone, letting
users generate the keys during initial logins. After the key is generated, the login applet searches external media and the user's home directory for
available keys. The user selects the correct key and enters the matching
to complete the login.
passphrase
For more information, see
.
How to Configure Public Key Authentication
RADIUS
External RADIUS servers can be queried by the appliance to authenticate users. RADIUS servers are often used for external authentication
methods that require users to enter a secondary challenge password.
RADIUS servers are also integrated with some hardware token solutions. The hardware token generates a login
and the RADIUS
passphrase
server interfaces with the external security appliance from the hardware token vendor, validating the string from the hardware key
generator. Challenge images can be used in combination with RADIUS authentication.
Because the RADIUS server is an external authentication service, it is not managed by the appliance. You must verify that the user information
hosted on the RADIUS server corresponds to the information stored in the user database on the Barracuda SSL VPN.
For more information, see
and
Example - How to Install and Configure YubiRADIUS
Example - Authentication with SMS Passcode RADIUS
.
OTP (One-Time Password)
You can use one-time password (OTP) authentication as only a secondary authentication module. The OTP is generated by the appliance at login
and is only valid for a short period of time. The OTP can be delivered by email or SMS (if an external SMTP to SMS service is available). If you do
not want users to wait for OTPs during login, you can configure the appliance to deliver OTPs before login and set a longer expiration time (hours
or days). If a user's OTP expires before it can be used, a new OTP is sent during the user's next login. External OTP systems (e.g.,
For more information, see
How to Configure One-Time Password (OTP) Authentication
Personal Questions
You can use the Personal Questions module as only a secondary authentication module. It does not require any external servers or configuration.
When users initially log in, they are asked five questions and their answers are stored by the module.
To authenticate a user, the module randomly selects one of the
questions and compares the user input to the stored answer. If the
preconfigured
user input matches the answer, the user is logged in.
Hardware Token Authentication
Two factor or multi factor authentication is considered to be strong authentication, using
a combination of the "something you know" and "something you have" principles. For
the Barracuda SSL VPN these hardware solutions are based on two different
authentication mechanisms, the RADIUS and the SSL Client Certificate authentication
modules.
In this article:
Hardware Token Authentication using SSL Client Certificates