2.3 - Authentication Methods

AAA

Authentication, Authorization, and Accounting — the framework used by protocols like RADIUS and TACACS+ to control access

RADIUS

Remote Authentication Dial-in User Service

Common AAA protocol supported on a wide variety of platforms

centralizes authentication for routers, switches, firewalls, server logins, remote VPN access, and 802.1X

available on almost any server OS (not just dial-in)

TACACS+ (Terminal Access Controller Access-Control System Plus)

• Latest version of TACACS

• remote authentication protocol with more authentication requests/response codes

• released as an open standard in 1993

• commonly found on Cisco devices

Kerberos

• Network authentication protocol — authenticate once and be trusted by the system (no re-authenticating to everything)

• uses mutual authentication (client AND server) and protects against on-path and replay attacks

• MIT standard since the 1980s

Kerberos and Microsoft

Microsoft began using Kerberos in Windows 2000, based on the Kerberos 5.0 open standard; compatible with other OSes and devices

SSO with Kerberos

• Authenticate one time using cryptographic tickets (lots of backend ticketing)

• no constant username/password input

• only works with Kerberos-friendly systems

Mutual authentication

Both the client AND the server authenticate each other (used by Kerberos)

protects against on-path

What do timestamps in Kerberos protect against?

Replay attacks (Attacker re-sends captured valid messages later)

If the message is too old (stale) it wont work.

Which auth method to use?

Often determined by what's available:

• RADIUS = broad/VPN concentrators

• TACACS+ = probably a Cisco device

• Kerberos = probably a Microsoft network

Multi-factor authentication (MFA)

Using more than one factor can be expensive (hardware tokens, scanners) or inexpensive (free smartphone apps)

MFA factors

1. Something you KNOW (password)

2. something you HAVE (token/phone)

3. something you ARE (biometrics)

4. somewhere you ARE (location)

5. something you DO (behavior/gesture)