Authentication

Authentication

• 1.
  AUTHENTICATION
• 2.
  THE AUTHENTICATION PROCESS •AUTHENTICATION • ACT OF CONFIRMING THE IDENTITY OF A POTENTIAL USER • VERIFY IDENTITY BY PROVIDING ONE OR MORE OF: • SOMETHING YOU KNOW • SOMETHING YOU HAVE • SOMETHING YOU ARE • SOMETHING YOU DO • MULTIFACTOR • NETWORK AUTHENTICATION FORMS: • LOCAL AUTHENTICATION • MOST COMMON FORM OF AUTHENTICATION • CENTRALIZED AUTHENTICATION SERVICE
• 3.
  AUTHENTICATION SERVICES • AUTHENTICATION- PROCESS OF VERIFYING CREDENTIALS • AUTHENTICATION SERVICES PROVIDED ON A NETWORK TO AUTHENTICATE, AUTHORIZE, AND ACCOUNTABILITY • COMMON TYPES OF AUTHENTICATION SERVERS: • KERBEROS • RADIUS • TACACS • LDAP • SAML
• 4.
  CENTRALIZED AUTHENTICATION • ALLEVIATESTHE NEED TO PROVIDE EACH SERVER ON THE NETWORK WITH A SEPARATE DATABASE OF USERNAMES AND PASSWORDS • SUBSTANTIAL DOWNSIDE: • AUTHENTICATION SERVER BECOMES A SINGLE POINT OF FAILURE • DIFFERENT AUTHENTICATION METHODS • KERBEROS, • TACACS+ • RADIUS 4
• 5.
  RADIUS • RADIUS (REMOTEAUTHENTICATION DIAL IN USER SERVICE) - DEVELOPED IN 1992 AND BECAME INDUSTRY STANDARD • ORIGINALLY DESIGNED FOR REMOTE DIAL-IN ACCESS TO CORPORATE NETWORK • TRANSMITS UNENCRYPTED AUTHENTICATION PACKETS ACROSS THE NETWORK • REMOTE IN NAME ALMOST MISNOMER: RADIUS AUTHENTICATION USED FOR MORE THAN CONNECTING TO REMOTE NETWORKS • WITH DEVELOPMENT OF IEEE 802.1X PORT SECURITY FOR BOTH WIRED AND WIRELESS LANS, RADIUS SEEN EVEN GREATER USAGE
• 6.
  RADIUS: CLIENTS • RADIUSCLIENT IS NOT DEVICE REQUESTING AUTHENTICATION • RADIUS CLIENT IS DEVICE LIKE WIRELESS AP OR DIAL-UP SERVER RESPONSIBLE FOR SENDING USER CREDENTIALS AND CONNECTION PARAMETERS IN FORM OF RADIUS MESSAGE TO RADIUS SERVER • RADIUS SERVER AUTHENTICATES AND AUTHORIZES RADIUS CLIENT REQUEST AND SENDS BACK RADIUS MESSAGE RESPONSE • RADIUS CLIENTS ALSO SEND RADIUS ACCOUNTING MESSAGES TO RADIUS SERVERS
• 7.
  KERBEROS • KERBEROS -AUTHENTICATION SYSTEM DEVELOPED AT MIT THAT USES ENCRYPTION AND AUTHENTICATION FOR SECURITY • MOST OFTEN USED IN EDUCATIONAL AND GOVERNMENT SETTINGS • NOT RECOMMENDED FOR AUTHENTICATION OF OUTSIDE USERS • SENDS PASSWORDS IN CLEARTEXT • KERBEROS TICKET: • CONTAINS INFORMATION LINKING IT TO THE USER • USER PRESENTS TICKET TO NETWORK FOR A SERVICE • DIFFICULT TO COPY • EXPIRES AFTER A FEW HOURS OR A DAY
• 8.
  FIREWALLS • SOME FIREWALLSPROVIDE A VARIETY OF AUTHENTICATION METHODS • FIREWALLS ARE NOT JUST FOR PACKET FILTERING ANYMORE • MOST FIREWALLS MAKE USE OF ONE OR MORE WELL-KNOWN SYSTEMS • RADIUS AND TACACS+
• 9.
  TERMINAL ACCESS CONTROLACCESS CONTROL SYSTEM (TACACS) • TERMINAL ACCESS CONTROL ACCESS CONTROL SYSTEM PLUS(TACACS+) - AUTHENTICATION SERVICE COMMONLY USED ON UNIX DEVICES • COMMUNICATES BY FORWARDING USER AUTHENTICATION INFORMATION TO A CENTRALIZED SERVER • LATEST AND STRONGEST VERSION OF A SET OF AUTHENTICATION PROTOCOLS DEVELOPED BY CISCO SYSTEMS • PROVIDE THE AAA SERVICES • AUTHENTICATION, AUTHORIZATION, ACCOUNTING • USES A HASHING ALGORITHM (MD5) TO KEEP THE PASSWORD ITSELF A SECRET
• 10.
  COMPARISON OF RADIUSAND TACACS+ • FILTERING CHARACTERISTICS • TACACS+ USES TCP PORT 49 • RADIUS USES UDP PORT 1812 AND 1813 • SEE TABLE 3-3 • NAT CHARACTERISTICS • RADIUS DOESN’T WORK WITH NETWORK ADDRESS TRANSLATION (NAT) • TACACS+ SHOULD WORK WITH NAT SYSTEMS • STATIC IP ADDRESS MAPPINGS WORK BEST FOR BOTH
• 11.
  PASSWORD SECURITY ISSUES •MANY AUTHENTICATION SYSTEMS DEPEND IN PART OR ENTIRELY ON PASSWORDS • METHOD IS TRULY SECURE ONLY FOR CONTROLLING OUTBOUND INTERNET ACCESS • PASSWORD GUESSING AND EAVESDROPPING ATTACKS ARE LIKELY ON INBOUND ACCESS ATTEMPTS • AVOID VULNERABILITIES BY ENSURING THAT NETWORK’S AUTHORIZED USERS • PROTECT THEIR PASSWORDS EFFECTIVELY • OBSERVE SOME SIMPLE SECURITY HABITS
• 12.
  THE SHADOW PASSWORDSYSTEM • LINUX STORES PASSWORDS IN THE /ETC/SHADOW FILE • IN ENCRYPTED FORMAT USING A ONE-WAY HASH FUNCTION • LINUX STORES USER NAMES IN THE /ETC/SHADOW FILE • SHADOW PASSWORD SYSTEM • FEATURE OF THE LINUX OPERATING SYSTEM • ENABLES THE SECURE STORAGE OF PASSWORDS • FILE HAS RESTRICTED ACCESS • PASSWORDS ARE STORED ONLY AFTER BEING ENCRYPTED WITH THE SALT VALUE AND AN ENCODING ALGORITHM • ON WINDOWS THE FILE IS CALLED SAM • THE HASHES ARE STORED IN THE WINDOWS SAM FILE. THIS FILE IS LOCATED ON YOUR SYSTEM AT C:WINDOWSSYSTEM32CONFIG BUT IS NOT ACCESSIBLE WHILE THE OPERATING SYSTEM IS BOOTED UP.
• 13.
  ONE-TIME PASSWORD SOFTWARE •TWO TYPES OF ONE-TIME PASSWORDS ARE AVAILABLE: • CHALLENGE-RESPONSE PASSWORDS • AUTHENTICATING COMPUTER OR FIREWALL GENERATES A RANDOM NUMBER (THE CHALLENGE) AND SENDS IT TO THE USER, WHO ENTERS A SECRET PIN OR PASSWORD (THE RESPONSE) • PASSWORD LIST PASSWORDS • USER ENTERS A SEED PHRASE, AND THE PASSWORD SYSTEM GENERATES A LIST OF PASSWORDS
• 14.
  CERTIFICATE BASED AUTHENTICATION •USE OF DIGITAL CERTIFICATES TO AUTHENTICATE USERS • MUST SET UP A PUBLIC-KEY INFRASTRUCTURE (PKI) • GENERATES KEYS FOR USERS • USER RECEIVES A CODE CALLED A PUBLIC KEY • GENERATED USING THE SERVER’S PRIVATE KEY • USES THE PUBLIC KEY TO SEND ENCRYPTED INFORMATION TO THE SERVE
• 15.
  802.1X WI-FI AUTHENTICATION •PROVIDES FOR AUTHENTICATION OF USERS ON WIRELESS NETWORKS • REQUIRES THE USE OF A SMART CARD OR DIGITAL CERTIFICATE • WI-FI USES OF EXTENSIBLE AUTHENTICATION PROTOCOL (EAP) • ENABLES A SYSTEM THAT USES WI-FI TO AUTHENTICATE USERS ON OTHER KINDS OF NETWORK OPERATING
• 16.
  SUMMARY • FIREWALLS CANMAKE USE OF MANY DIFFERENT AUTHENTICATION SCHEMES: USER, CLIENT, SESSION • CENTRALIZED AUTHENTICATION SYSTEM • FIREWALL WORKS IN TANDEM WITH AUTHENTICATION SERVER • SINGLE-WORD, STATIC PASSWORD SYSTEMS • RECEIVE A PASSWORD FROM A USER, COMPARE IT AGAINST A DATABASE OF PASSWORDS, AND THEN GRANT ACCESS IF A MATCH IS MADE • ONE-TIME PASSWORD SYSTEMS • GENERATE A PASSWORD EACH TIME THE USER ATTEMPTS TO LOG ON TO THE NETWORK