IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.41 Secure configuration of remote access under
Windows NT
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
Users can connect to local Windows NT systems from remote IT systems via
RAS (Remote Access Service). For this, the RAS-client must be installed on
the remote IT system and the RAS-server on the local IT system which
accepts the remote connection. Using RAS, these users can work as if they
were directly connected to the network. The remote clients use standard
programmes to access resources. With the help of the File-Manager or
Explorer, network drives and printers are, for example, connected. These
connections are permanent, i.e. users do not have to recreate connections to
network resources during one session. As clients, the systems Windows NT,
Windows 95, WfW, MS-DOS and OS/2 are supported.
The user creates the connection to the RAS-server with a local modem, X.25
or ISDN-card. The RAS-server, which is run on the Windows NT server,
authenticates and serves the user until either he or the administrator terminates
the session. The RAS connection provides all the services (file and printer
sharing, database access and notifications) that are normally available to a user
connected via a LAN.
Access to the RAS is provided for the whole pool of Windows NT user
accounts. With the User-Manager, permission to dial in to the local network
can be provided to single users, user groups or all users. Furthermore, RAS
administration offers an option which allows access either to all resources
which the RAS host can access within the network, or only to the resources
available on the local computer. The users then use their domain log-on to
create a connection via RAS. Once the user's access permission has been
checked by the RAS, he can use the local resources or, if he has been granted
the appropriate permission, the resources in the whole domain as well as in
trusted domains.
Via the Challenge Handshake Authentication Protocol (CHAP) the Remote
Access Server provides the securest form of encrypted access permission
which is supported by the server as well as the client. CHAP allows the RAS
server to systematically make a selection from the securest encryption
mechanism to the most insecure procedure of plain-text transmission and it
protects transmitted passwords in the process.
CHAP allows the employment of diverse encryption algorithms. RAS in
particular uses the cryptographic algorithm MD5. RAS refers to DES
encryption for authentication if the client and the server work with RAS. For
data communication, Windows NT, Windows for Workgroups and Windows
95 select among themselves the DES encrypted confirmation of authenticity.
When connecting to external RAS servers or client software, a confirmation of
authenticity is possible with SPAP or unencrypted text, if the external product
does not support an encrypted confirmation of authenticity.
MD5, an encryption scheme installed by diverse PPP implementations for
encrypted confirmations of authenticity, can be selected from the Microsoft
RAS-Client if a connection to other RAS servers exists.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000