TCP/IP Tutorial and Technical Overview - IBM Redbooks

Accounting This is typically the third action after authentication and
authorization. But again, neither authentication nor
authorization are required. Accounting is the action of
recording what a user is doing and has done.
In the distributed client/server security database model, a number of
communications servers, or clients, authenticate a dial-in user's identity through
a single, central database, or authentication server. The authentication server
stores all information about users, their passwords, and access privileges.
Distributed security provides a central location for authentication data that is
more secure than scattering the user information on different devices throughout
a network. A single authentication server can support hundreds of
communications servers, serving up to tens of thousand of users.
Communications servers can access an authentication server locally or remotely
over WAN connections.
Several remote access vendors and the Internet Engineering Task Force (IETF)
have been in the forefront of this remote access security effort, and the means
whereby such security measures are standardized. Remote Authentication Dial
In User Service (RADIUS) and Terminal Access Controller Access Control
System (TACACS) are two such cooperative ventures that have evolved out of
the Internet standardizing body and remote access vendors.
Remote Authentication Dial-In User Service (RADIUS) is a distributed security
system developed by Livingston Enterprises. RADIUS was designed based on a
previous recommendation from the IETF's Network Access Server Working
Requirements Group. An IETF Working Group for RADIUS was formed in
January 1996 to address the standardization of RADIUS protocol; RADIUS is
now an IETF-recognized dial-in security solution (RFC 2058 and RFC 2138).
Similar to RADIUS, Terminal Access Controller Access Control System
(TACACS) is an industry standard protocol specification, RFC 1492. Similar to
RADIUS, TACACS receives an authentication request from an NAS client and
forwards the user name and password information to a centralized security
server. The centralized server can either be a TACACS database or an external
security database. Extended TACACS (XTACACS) is a version of TACACS with
extensions that Cisco added to the basic TACACS protocol to support advanced
features. TACACS+ is another Cisco extension that allows a separate access
server (the TACACS+ server) to provide independent authentication,
authorization, and accounting services.
Although RADIUS and TACACS authentication servers can be set up in a variety
of ways, depending on the security scheme of the network they are serving, the
basic process for authenticating a user is essentially the same. Using a modem,
a remote dial-in user connects to a remote access server (also called the
network access server or NAS) with a built-in analog or digital modem. After the
Chapter 22. TCP/IP security 873