A single- or multi-protocol buffering proxy accepts communication option negotiation commands from a client before establishing a connection between the client and a host. The proxy negotiates a limited set of options with the client before the connection is established and buffers (accepts and temporarily stores without responding to) other option negotiation commands from the client. The proxy accepts credentials from a user and establishes, or denies the connection based on the credentials. If the connection is established, the proxy buffers option negotiation commands sent by the host. After the proxy logs in to the host on behalf of the user or the user logs in directly, the proxy sends each party's buffered option negotiation commands to the other party, ceases buffering option negotiation commands and enters a “pass-through” mode, in which the proxy passes characters and commands between the parties until the session ends. The proxy uses the credentials to allow or deny subsequent connection requests, without re-prompting for credentials.