Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Administrator authentication
Chapter 10: Setting Up Authentication
Authentication overview
When you log into the Sidewinder G2, you are authenticated using either
standard UNIX password authentication or a stronger form of authentication,
such as SafeWord PremierAccess. If standard UNIX password authentication
is used, the password you provide is maintained in the user database, and the
Sidewinder G2 checks the database to validate your password. Dynamic
passwords, called passcodes, or challenge/response information generated for
stronger authentication methods are not stored on the Sidewinder G2. Instead,
they are located on the associated authentication server. (Strong
authentication is described in the next section.) The default administrator
authentication method is configured in the Firewall Accounts window. For
information on configuring the default administrator authentication method, see
“Setting up and maintaining administrator accounts” on page 43.
Administrators can use Telnet or SSH to access a Sidewinder G2 via a
command line interface. By default, standard UNIX password authentication is
used to validate this type of remote login attempt.
Note: Secure Computing recommends using a strong authentication method for
login attempts from a remote server.
Weak versus strong authentication
Secure Computing uses the terms “weak” and “strong” when referring to the
level of security provided by an authentication method. The differences are
discussed in the following section.
Weak authentication
A weak authentication method merely requires a user to enter the same
password each time he or she logs on. The “standard” UNIX password process
is considered to be a weak authentication method. If someone “sniffs” the
password off the phone line or network as it is transmitted, they can
conceivably use that password to break into the system. Because your internal
network is thought to be “trusted,” this type of authentication is generally used
for authenticating internal-to-external proxy connections.
275