Syngress - Eleventh Hour Network+ Exam N10-004 Study Guide (11 ...

136 CHAPTER 8 Security Standards and Services
■
Securing LDAP:
■ LDAP clients must authenticate to the server before being allowed access
to the directory.
■ The LDAP server constitutes a security realm, which is used to authenticate
users.
■ Clients (users, computers, or applications) connect to the LDAP server
using a distinguished name and authentication credentials, usually a
password.
■ It is possible for users to make the connection with limited or no
authentication, by using either anonymous or simple authentication.
■ To secure LDAP, anonymous clients should be limited or not used, ensuring
that only those with proper credentials are allowed access to the
information.
■ Authentication information is sent from the client to the server as part of
a “bind” operation, and the connection is later closed using an “unbind”
operation.
■ The connection can be configured to use TLS to secure transmissions and
protect any data sent between the client and the server.
■ LDAP can also be used over Secure Sockets Layer (SSL), which encrypts
LDAP connections.
■ TCP/UDP port 389 and LDAPS uses port 636.
PASSWORD AUTHENTICATION PROTOCOL AND CHALLENGE HANDSHAKE
AUTHENTICATION PROTOCOL
■
■
PAP PAP was used to authenticate users using usernames and passwords.
PAP uses a two-way handshake and transmits the username and password
in American Standard Code for Information Interchange (ASCII)
without any encryption. PAP was replaced by CHAP to provide more
security.
CHAP CHAP is a remote access authentication protocol used in conjunction
with PPP to provide security and authentication to users of remote
resources. CHAP is used to periodically verify the identity of the peer using
a three-way handshake. This is done upon initial link establishment and
may be repeated anytime after the link has been established.
TERMINAL ACCESS CONTROLLER ACCESS CONTROL SYSTEM/TERMINAL
ACCESS CONTROLLER ACCESS CONTROL SYSTEM PLUS
Terminal access controller access control system (TACACS) is used in authenticating
remote users. TACACS has gone through three major “generations”:
■
■
TACACS TACACS was first developed during the days of Advanced Research
Projects Agency Network (ARPANET), and it offers authentication and
authorization, but it does not offer any accounting tools.
Terminal Access Controller Access-Control System Plus (TACACS+)
TACACS+ is a Cisco proprietary version of TACACS that is incompatible
with previous versions. TACACS+ uses individual databases for each.