Symantec™ Security Gateways Reference Guide - Sawmill

Controlling user accessAuthentication79The security gateway supports the following methods for authenticating users:■■■■■■■■■Bellcore S/KeyEntrustGateway passwordLightweight Directory Access Protocol (LDAP)NT Domain (Microsoft Windows only)PassGo DefenderRemote Authentication Dial In User Service (RADIUS)RSA Security SecurIDTACACS+Administrators can create custom templates that apply one or several of these authentication methods in adefinable order. In addition to these methods, which are protocol-dependent, the security gateway supportsan Out of Band Authentication (OOBA) scheme incorporating any of the above methods. The securitygateway can also be configured to set up simple user authentication based on static users.Weak and strong authentication systemsAuthentication systems are defined as weak or strong based on how many times the same password is used.Authentication systems that use the same password continuously (multi-use) are weak. Multi-usepasswords offer a potential attacker time to figure out the password, something strong systems do not.Authentication systems that require a different password for each session for each use (single-use) arestrong. Strong authentication systems are inherently more secure than weak ones since they are not asvulnerable to password sniffing.Note: Although the security gateway supports both weak and strong authentication methods, you shoulduse a strong authentication system for anyone requesting access.Bellcore S/Key authenticationBellcore S/Key is a software-based strong authentication system. The Bellcore S/Key server is integratedwithin the security gateway. Bellcore S/Key generators for PC and UNIX clients are included. Figure 6-2shows that Bellcore S/Key works by running a user password and seed value through a cryptographic hashfunction a fixed number of times. A cryptographic hash function takes an input and creates an output. Theinput is not recoverable from the output.Figure 6-2S/Key hash iteration