Syngress - Eleventh Hour Network+ Exam N10-004 Study Guide (11 ...

134 CHAPTER 8 Security Standards and Services
Client Requests Authorization
Client
Internet
RADIUS Client
Remote Server queries
central repository
RADIUS Server
FIGURE 8.5
RADIUS authentication
process
Remote Server’s Response
RADIUS Server responds with
either an allow or deny
In a distributed RADIUS environment, a RADIUS server forwards the authentication
request to an enterprise RADIUS server using a protocol called proxy
RADIUS. RADIUS may be vulnerable to buffer overflow attacks. The RADIUS
authentication process is depicted in Figure 8.5.
Biometric devices can provide a higher level of authentication than, for example,
a username/password combination.
KERBEROS
Kerberos is a network protocol designed to centralize the authentication information
for the user or service requesting the resource. This allows authentication of
the entity requesting access (user, machine, service, or process) by the host of the
resource being accessed through the use of secure and encrypted keys and tickets
(authentication tokens) from the authenticating key distribution center (KDC).
Characteristics of Kerberos are as follows:
■ It allows for cross-platform authentication.
■ It centralizes the processing of credentials for authentication.
■ Kerberos uses time stamping of its tickets to help ensure that they are not
compromised by other entities. It uses an overall structure of control that
is called a realm.
■ In a Kerberos realm, the Key Distribution Server (KDC) acts as both an
authentication server and as a ticket granting server.
■ Kerberos uses a time stamp to limit the possibility of replay or spoofing of
credentials. Microsoft’s Kerberos implementation has a 5-min. time delta.
If clocks are not synchronized between the systems, the credentials (tickets)
will not be granted if the time differential exceeds the established limits.
LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL
Directory services are used to store, retrieve, and manage information about
objects, such as user accounts, computer accounts, mail accounts, and information
on resources available on the network. Some of the directory services that
are produced by vendors include the following:
■
Active Directory was developed by Microsoft for networks running Windows
2000 Server, Windows 2003 Server, or Windows 2008.