4.6.2. Gateway Users

Gateway users are one of the central components of suSSHi, as they represent the individual user identities that are authorized to access target systems through the platform. User management is handled centrally to ensure clear accountability, consistent access control, and secure authentication across all connected environments.

A dedicated and unique personal user account is created for every individual who will use suSSHi. Each account stores the corresponding SSH public keys of the respective user, enabling secure authentication through SSH Public Key Authentication, which is the recommended authentication method.

Note

If required for specific workflows or compatibility reasons, a static password can additionally be configured for a user account. However, password-based authentication should generally only be used in exceptional cases or specialized scenarios, such as integrations with one-time password systems or temporary authentication workflows.

4.6.2.1. User Objects

A user object represents an individual identity within suSSHi, typically corresponding to a real person who is authorized to access systems through the platform.

During the user creation process, organizational and identification details such as the user’s name and e-mail address can be defined to ensure clear assignment and traceability of activities. If required for specific authentication workflows, a gateway password can additionally be configured for the user object.

Note

Whenever possible, SSH Public Key Authentication should be used as the preferred and recommended authentication method. The user interface supports the formats PKCS1 (openSSHs .pub files), PKCS8 and SSH Public Key File Format (RFC 4716).

To simplify permission management and access administration, a user object can also be assigned to one or more groups directly during its creation. Group memberships can then be used to centrally manage access rights and organizational structures across the suSSHi environment.

4.6.2.2. User Groups

Analogous to source IP groups, gateway user groups are used to logically combine individual gateway users into a single manageable unit. This grouping mechanism simplifies administration by allowing users to be organized according to functional, organizational, or operational criteria.

By assigning users to groups, access control becomes significantly more efficient. Instead of modifying multiple access rules individually, administrators can adjust permissions centrally at the group level. This means that adding or removing a user from a group automatically updates their effective access rights across all associated rules, reducing administrative overhead and minimizing the risk of configuration errors.

Gateway user groups therefore provide a scalable and consistent way to manage user permissions, especially in environments with a large number of users or frequently changing access requirements.