Authentication Authorization and Accounting AAA and Identity Management

AAA offers different solutions that provide access control to network resources. This section introduces AAA and identity management concepts.

Authentication is the process of validating users based on their identity and predetermined credentials, such as passwords and other mechanisms like digital certificates. Authentication is widely used in many different applications, from a user attempting to log in to the network, web server, and wireless access point to an administrator logging in to a firewall, router, or any other network device to successfully configure the former.

The authentication concept is simple. Before you can withdraw money from your favorite bank, the teller asks for your credentials (driver's license, account number, and so on). Similarly, networking devices, servers, and other systems can ask you for credentials such as passwords and digital certificates for you to obtain access to the network or any other resources.

Authorization is the method by which a network device assembles a set of attributes that regulates what tasks the user is authorized to perform. These attributes are measured against a user database. The results are returned to the network device to determine the user qualifications and restrictions.

Accounting is the process of gathering and sending user information to an AAA server used to track login times (when the user logged in and logged off) and the services that users access. This information can be used for billing, auditing, and reporting purposes.

Two common AAA protocols are used in networking today:

• Remote Authentication Dial-in User Service (RADIUS)

• Terminal Access Controller Access Control System Plus (TACACS+)

RADIUS

RADIUS is a widely implemented authentication standard protocol that is defined in RFC 2865. RADIUS operates in a client/server model. A RADIUS client is usually referred to as a network access server (NAS). A NAS is responsible for passing user information to the RADIUS server. Network devices such as routers, firewalls, and switches can act as a NAS and authenticate users based on the RADIUS server response.

Cisco develops and sells a RADIUS and TACACS+ server called Cisco Secure Access Control Server (ACS). Cisco Secure ACS supports a rich set of AAA features and applications. These advanced features include the following:

• Lightweight Directory Access Protocol (LDAP) and Open Database Connectivity (ODBC) user authentication support

• Flexible 802.1X authentication type support, including Extensible Authentication Protocol Transport Layer Security (EAP-TLS), Protected EAP (PEAP), EAP-Flexible Authentication via Secure Tunneling (EAP-FAST), and EAP-Message Digest Algorithm 5 (EAP-MD5) and other protocols

• Timed-based access

• Downloadable for any Layer 3 device, including Cisco routers, Cisco PIX firewalls, Cisco ASA, and Cisco VPNs

• Device command authorization

• Advanced database synchronization and replication features

• Network access restrictions

• Detailed reporting and accounting capabilities

• User and device group profiles

NOTE For more information about Cisco Secure ACS, go to http://www.cisco.com/go/acs.

Figure 1-11 illustrates the basic RADIUS authentication process.

Figure 1-11 RADIUS Authentication Process

AAA Client

Access-Request

Access-Accept (With Authorization Attributes)

Accounting Request (Start)

Accounting Response to Client

Accounting Request (Stop)

Accounting Response to Client

RADIUS Server

RADIUS Server

The following are the steps illustrated in Figure 1-11.

Step 1 An access-request is sent from the AAA client (a router in this example) to the RADIUS server.

Step 2 If the user is successfully authenticated, an access-accept is sent from the RADIUS server to the AAA client. This access-accept packet can contain authorization attributes if authorization is enabled. If the user is not successfully authenticated, an access-reject is sent instead.

Step 3 An accounting request (start) message is sent from the AAA client (if configured to do accounting) to the RADIUS server.

Step 4 If the RADIUS server is configured for accounting, it replies with an acknowledgement.

Step 5 At the end of the user session, an accounting request (stop) message is sent from the AAA client (if configured to do accounting) to the RADIUS server.

Step 6 If the RADIUS server is configured for accounting, it replies with an acknowledgement.

This exchange is done over UDP. Older implementations of RADIUS use UDP port 1645

for authentication and UDP port 1646 for accounting. The newer implementations use UDP

port 1812 for authentication and UDP port 1813 for accounting.

NOTE A RADIUS server can also send IETF or vendor-specific attributes to the AAA client depending on the implementation and services used. These attributes can contain information such as an IP address to assign the client and authorization information. RADIUS servers combine authentication and authorization phases into a single request and response communication cycle.

TACACS+

TACACS+ is an AAA security protocol developed by Cisco that provides centralized validation of users who are attempting to gain access to network access devices. The TACACS+ protocol offers support for separate and modular AAA facilities. The primary goal of the TACACS+ protocol is to supply complete AAA support for managing multiple network devices. Unlike RADIUS, TACACS+ uses TCP port 49 by default instead of UDP for its communications. However, it can allow vendors to use UDP. Cisco products use the TCP version for their TACACS+ implementation. The TACACS+ authentication concept is similar to RADIUS. The NAS sends an authentication request to the TACACS+ server, which in turn sends any of the following messages back to the NAS:

• ACCEPT: The user has been successfully authenticated and the requested service will be allowed. If authorization is required, the authorization process will begin at this point.

• REJECT: User authentication was denied. The user may be prompted to retry authentication depending on the TACACS+ server and NAS.

• ERROR: An error took place during authentication. This can be happen because of network connectivity problems or a configuration error.

• CONTINUE: The user is prompted to provide further authentication information.

After the authentication process is complete, if authorization is required, the TACACS+ server proceeds with the authorization phase. The user must first successfully be authenticated before proceeding to TACACS+ authorization.

As an industry standard, RADIUS is a more widely deployed protocol than TACACS+.

Continue reading here: Creating a Computer Security Incident Response Team CSIRT

Was this article helpful?

0 0