4.2 Flashcards
What does AAA stand for?
Authorization, Authentication and Accounting
What are the AAA framework steps to get access to a network device?
- Identification(usually the username/who we are)
- Authentication(usually the password/prove who we are)
- Authorization(based on the identification and authentication, what access do we have?)
- Accounting(resources used: Login time, data sent and received, logout time)
What does RADIUS stand for?
Remote Authentication Dial-in User Service
What does RADIUS do?
Its one of more common AAA protocols
Whats an example of RADIUS?
centralize authentication for users like routers, switches, firewalls, remote VPN access since RADIUS services are available on almost any server operating system.
What does TACACS stand for?
Terminal Access Controller Access-Control System
What does TACACS do?
It’s an alternative to RADIUS aremote authentication protocol created to control access to dial-up lines to APRANET.
Whats XTACACS?
(Extended TACACS) It’s an additional support for accounting and auditing.
Whats TACACS+?
Latest version of TACACS which offers more authentication requests and response codes.
What are Kerberos?
They are a network authentication protocol which only authenticates once and once it’s trusted by the entire system, they wont be a need to re-authenticate to everything.
What does SSO stand for?
Single Sign-On and it’s part of the kerberos which authenticates one time. This means no constant username and password input to save time. It only works with Kerberos protocols, but not everything is kerberos-friendly.
What is LDAP used for?
It’s the protocol for reading and writing directories over an IP network(an organized set of records, like a phone directory(LDAP uses tcp/389 and udp/389)
Whats the use of local authentication?
Credentials are stored on the local device(doesnt use a centralized database). Most devices include an initial account. Its difficult to scale local accounts(no centralized administration so everything must be added or changed on all devices) but its useful as a backup.
What are certificates used for?
They are used in certificate-based authentications like smart cards(private key is on the card)
Whats a PIV card?
(Personal Identity Verification card) It’s a US Federal Government smart card with picture and identification info.
Whats a CAC?
(Common Access Card) It is used by US Department of Defense smart card with picture and identification.
Whats IEEE 802.1X used for?
To gain access to the network using a certificate that is stored on a device or a separate physical device.
What is auditing used for?
With the logged information, we can see how are our resources used or are our systems and applications secure?(Like time-of-day restrictions that we can apply to a lab that nobody uses at 3 am.
What is multi-factor authentication?
It's when more than one factor is used to authenticate: Something you are something you have something you know somewhere you are something you do
Whats an example of something you know?
Password, PIN and pattern
Whats an example of something you have?
Smart card, USB token,pseudo random authentication code for hardware or software and SMS to a phone with a code.
Whats an example of something you are?
Biometric authentication(Not foolproof)
Whats an example of somewhere you are?
Provide a factor based on your location, IP address(works with IPv4 and not so much with IPv6) and mobile device locations services(needs to be able to receive GPS info)
Whats an example of something you do?
A personal way of doing things, handwriting analysis, typing technique
(these are very similar to biometrics which means close to something you are)
Whats 802.1X?
It’s a port based(physical interfaces not tcp or udp) NAC(Network Access Control) which means clients dont get access until you authenticate. 802.1X uses EAP and RADIUS, but also we need to disable our unused ports and duplicate the MAC address checking.
Whats port security?
It prevents unauthorized users from connecting to a switch interface(it will alert or disable the port) which works based on the source MAC address. Each port has its own config.
How does port security work?
- Configure a maximum number of source MAC addresses on an interface.
- The switch monitors the number of unique MAC addresses.
- Once you exceed the maximum, port security activities.
Whats MAC filtering?
(Media Access Control) It’s the limitation of access through the physical hardware address. To find the working MAC addresses through packet captures
What is captive portal?
It’s an authentication to a network which is common in wireless networks.
How does the captive portal work?
After our device is connected to a network, access table recognizes a lack of authentication and redirects us to a captive portal page where it asks for username and password. Once proper authentication is validated, the web session continues(until captive portal removes our access)
Whats ACL used for?
(Access Control Lists) It’s used to allow or deny traffic. They are applied to routers or switch interfaces and are defined on the ingress or egress of an interface. ACLs evaluate on certain criteria(like source IP, destination IP, ICMP, TCp port numbers, UDP port numbers).
