Lecture-9-Authentication and Access Control

1. Introduction to Authentication and Access Control

1.1 Overview of Remote Access

• Enables remote employees to connect to the internal network to access office resources.

• Essential for users who work from home or travel frequently.

• Requires:

  • A server configured for incoming connections.

  • Client remote-access software (built-in on Windows since Windows 95).

• Remote Access Services (RAS): Combination of hardware/software for remote connections, popularized by Microsoft.

1.2 Security in Remote Access

• RAS requires secure protocols for tunneling (e.g., PPTP) and authentication (e.g., MS-CHAP, EAP).

• Supports various network protocols, not just TCP/IP.

2. Remote Desktop Protocol (RDP)

2.1 RDP Functionality

• Allows users to connect to computers running Microsoft’s Remote Desktop Services.

• Requires correct client software on the remote computer.

• Uses TCP port 3389; provides a graphical interface similar to the host desktop.

• Latest version: RDP 10.0.

2.2 RDP Security Features

• Offers 128-bit encryption with RC4 algorithm.

• Supports TLS 1.0 for secure connections.

3. Point-to-Point Protocol (PPP) & PPPoE

3.1 PPP

• A Layer 2 protocol providing authentication, encryption, and compression.

• Commonly used by ISPs for dial-up and DSL connections.

3.2 PPPoE

• Encapsulates PPP frames within Ethernet frames, addressing the rise of high-speed connections.

• Managed by Remote Authentication Dial In User Service (RADIUS).

• Operates in two stages: discovery (MAC address exchange) and session establishment.

4. Independent Computing Architecture (ICA)

• Created by Citrix for communication between servers and clients.

• Used primarily in Citrix’s WinFrame for cross-platform application access.

• Drawbacks include slower connections due to translation between different operating systems.

5. Secure Shell (SSH)

• Network protocol providing secure alternatives to command-line utilities like Telnet.

• Ensures data confidentiality and integrity via public-key cryptography.

• Authenticates remote computers using public/private key pairings.

6. Out-of-Band Management

• Manages servers without traditional network connectivity.

• Example includes HP's Integrated Lights-Out (iLO) for remote server management.

• Console port access for routers and switches exemplifies out-of-band management.

7. Virtual Network Computing (VNC)

• Remote desktop sharing system that uses the RFB protocol.

• Platform-independent, includes server and client components.

• Differs from RDP by sending raw pixel data.

8. Managing User Accounts and Password Security

8.1 Importance of Usernames and Passwords

• Essential for secure access control in networks.

• Discusses strategies for managing account access:

  • Disabling accounts of former users.

  • Anonymous accounts with limited access for multiple users.

8.2 Enhancing Password Security

• Characteristics of strong passwords:

  • Minimum length of 8 characters, maximum of 15.

  • Avoid common or easily-guessed passwords (e.g., "password", names).

• Encourage complex passwords with combinations of characters.

8.3 Password Management Features

• Built-in features in operating systems:

  • Automatic account lockouts after failed login attempts.

  • Password expiration policies.

9. Single Sign-On (SSO)

• Reduces the number of login credentials users must remember.

• Generates an access token for authorized resources upon initial login.

10. Local Authentication

• Authentication can occur against a domain or locally.

• Local databases for user accounts:

  • Windows uses SAM.

  • Linux uses /etc/passwd.

11. Lightweight Directory Access Protocol (LDAP)

11.1 Directory Services

• Centralizes data about users, groups, systems, etc.

• LDAP is a standard for accessing this data using TCP port 389 (SSL via port 636).

12. Digital Certificates

• Used for identity verification and public key association.

• X.509 standard outlines the structure for digital certificates, including issuer, subject, and public key details.

13. Multifactor Authentication (MFA)

• Enhances security by requiring multiple verification methods:

  • Knowledge-based (password).

  • Physical (biometrics).

  • Ownership (smart card).

  • Location and behavioral factors.

14. Public Key Infrastructure (PKI)

• Links users to public keys via certificate authorities for secure communications.

• Asymmetric cryptography enhances security compared to symmetric methods.

15. Kerberos

• A ticket-based authentication system utilizing strong encryption.

• Tickets are refreshed as long as users are logged in, but require synchronized clocks.

• Redundant servers are necessary to prevent single points of failure.

16. Authentication, Authorization, and Accounting (AAA)

16.1 RADIUS

• Centralizes user authentication and accounting info for remote access.

16.2 TACACS+

• Another AAA method; separates authentication and authorization, more stable than RADIUS.