Skip to main content

Connection to Linux and Windows Workstations

Your users can also log in or unlock their computer with their VaultysID wallet, just like they log in to VaultysHub: the computer displays a login request, the user validates it on their phone, and the session opens without entering a password.

Assisted Deployment

Connecting to workstations requires installing a component on each computer and associating it with your organization. It is deployed with the support of the Vaultys team: contact us to discuss and prepare its installation on your fleet.

How it Works​

  1. The computer is associated with your VaultysHub organization, and each local user is associated with the VaultysHub account of the person using it. This association is done once by scanning a QR code with the VaultysID wallet.
  2. Upon login, the computer displays a QR code or an 8-digit short code.
  3. The user scans the QR code or enters the code in their wallet from the organization's page. The wallet displays the computer and the IP address from which the request originated; the user validates it.
  4. The session opens or unlocks.

If the server is unreachable, or if the user refuses or does not validate in time (60 seconds), the computer reverts to login by password: no one is locked out of their workstation.

A workstation connection does not open VaultysHub

Validating a connection to a computer only opens the session of that computer: it does not provide any access to VaultysHub or the organization's applications.

On Linux​

The VaultysID module integrates with the system authentication (PAM). It covers:

  • the login screen and lock screen GNOME (GDM);
  • login on a text terminal (login);
  • the sudo and su commands, and desktop authorization requests (polkit);
  • SSH connections to the machine.

When a password is requested, the user can enter it as usual, or leave the field empty to log in with VaultysID. In a terminal (sudo, SSH…), a QR code is displayed with the short code; on the login and lock screens, only the short code is displayed.

With the short code, nothing is transmitted that could be used by a third party: the code is only accepted from the wallet of the person associated with the local account, and only for 60 seconds. A code read over someone's shoulder or intercepted is unusable.

No password is stored on the machine: it only retains the association between VaultysHub accounts and local users.

Prerequisites:

  • a recent Linux distribution, in x86_64 or arm64. Activation is automatic on Debian and Ubuntu; on other distributions (Fedora, RHEL, Arch…), the PAM configuration is adjusted during installation;
  • network access from the machine to your VaultysHub;
  • for SSH, interactive authentication enabled in the SSH server configuration.
Known Limitation

Upon opening a GNOME session with VaultysID (and not unlocking), the GNOME keyring and a personal folder encrypted by the password remain locked.

On Windows​

The Vaultys identification provider adds to the login and lock screen of Windows: the user selects the Vaultys login, scans the displayed QR code with their wallet, validates, and the session opens. On Windows, the connection is done by QR code only: the short code is not yet offered there.

The workstation association is done with the Vaultys Desktop Client application: the user indicates the address of your VaultysHub, scans the QR code with their wallet, and then enters the password for their Windows session once. This password is stored encrypted on the computer and transmitted to Windows when the connection is validated from the wallet.

Prerequisites:

  • Windows 10 64-bit or higher;
  • administrator rights on the workstation for installation (the installer adds the necessary Microsoft components if they are missing);
  • network access from the workstation to your VaultysHub.

On the VaultysHub Side​

You do not need to activate anything in the administration: connecting to workstations uses the VaultysID accounts and wallets of your users.

  • Users must be members of your organization and have already connected their VaultysID wallet to VaultysHub via QR code (this is what allows the use of the short code).
  • Disabling a user in VaultysHub immediately removes their VaultysID connection to their workstations: their request is denied, and they must use their password.
  • The audit log tracks each connection to a workstation, successful, failed, or denied, with the name of the computer, its system, and its IP address: consult the Audit Log.

To set up workstation connections in your organization, contact the Vaultys team.