Instructor: In this lesson,
we're going to talk about AAA servers, which stands
for authentication, authorization, and accounting,
and to understand AAA servers, the first thing we have to do
is understand how 802.1X works as a framework.
Instructor: 802.1X is a standardized framework
that's used for port-based authentication
on both wired and wireless networks.
Now, since 802.1X is just the framework,
it's actually going to utilize other mechanisms
to do the real authentication for us.
For example,
both the Remote Authentication Dial-In User Service,
known as RADIUS,
and the Terminal Access Controller
Access-Control System Plus, or TACACS+,
can both be utilized to conduct the authentication
using the 802.1X protocol.
There are three roles that are required
for an authentication to occur under 802.1X.
The first is the supplicant, which is the device or user
that's requesting access to the network,
such as PC1 in this image.
Then there's an authenticator, which is the device
through which the supplicant is attempting
to access the network.
Normally, this is going to be something like a switch,
a wireless access point, or a VPN concentrator.
Finally, there's the authentication server,
which is going to be the centralized device
that performs the authentication,
which is usually going to be your RADIUS
or your TACACS+ server.
Authentication occurs when a person's identity
is established with proof and is confirmed by the system.
You do this every single day.
In fact, you did it when you logged into this course.
When you entered in your email address and your password,
you were making a claim that you are the student
who paid for this course, and by doing that,
you are checked by the system and granted access.
Now, there are different ways to authenticate who you are.
In the real world, for example, if you get pulled over
for speeding by a police officer,
you may pull out your driver's license
and show them that it is you
and that you are who you say you are.
This is your proof.
Now, in the digital world,
we have five methods of authentication.
We have something you know, which would be something
like a password or a username,
we have something that you are, which would be something
like your fingerprint or an eye scan or a retina scan,
we have something you have, this would be something
like a token, a driver's license, or a credit card,
it could be something you do, which is the way
that you speak or the way that you sign your name,
and it can be somewhere you are, which we know
as your location factor based on your GPS location.
LDAP is the Lightweight Directory Access Protocol.
This is a database that's used to centralize information
about your clients and your objects on the network.
LDAP is essentially a simplified version of X.500,
which is a directory service,
and it contains a hierarchical organization of the users,
groups, servers, and systems inside your network.
LDAP communicates over port 389
when it's doing it unencrypted, and if you decide
to encrypt it using SSL or TLS, it's going to use port 636.
Now, while LDAP is considered cross-platform,
Microsoft created their own implementation of this,
known as AD or Active Directory.
In the Windows domain, Active Directory is used
to organize and manage everything on the network,
including those clients, servers,
devices, users, and groups.
Now, Active Directory can also be used
as part of your security policies or access control
through your group policies.
RADIUS is the Remote Authentication Dial-In User Service.
It provides centralized administration of dial-up, VPN,
and wireless authentication,
so that you can use that with both 802.1X
and the Extensible Authentication Protocol, or EAP.
RADIUS is a client server protocol that runs
over the seventh layer of the OSI model,
the application layer.
RADIUS is usually configured to be run on a separate server,
but it can also be loaded up on a Windows server
in smaller domain environments.
RADIUS is used to authenticate users,
authorize them to services,
and account for their usage of those services.
RADIUS also utilizes UDP for making its connections,
making it fairly fast
during its authentication and authorization functions.
Now, while RADIUS is a cross-platform standard,
there is a proprietary protocol from Cisco called TACACS+.
This is the Terminal Access Controller
Access-Control System Plus, which can perform the role
of an authenticator in an 802.1X network.
Now, it's up to you to determine which one is best
for your organization's needs.
Personally, I've used RADIUS almost exclusively
within my organizations.
I found that TACACS+ is a little bit slower to operate
because it's relying on TCP instead of UDP,
but TACACS+ does have some benefits.
It gives you some additional security
and independently conducts its authentication,
authorization, and accounting processes.
TACACS+ supports all network protocols,
but RADIUS, on the other hand,
doesn't support the remote access protocol,
NetBIOS Frame protocol, X.25 pegged connections,
and some others.
Overall, TACACS+ is an excellent choice,
but only if you're going to be using Cisco devices
across your network,
because if you want to have that cross-platform capability,
then you're going to have to go over with RADIUS,
the way that I've chosen in the past.
The second A is authorization.
Authorization occurs when a user is given access
to a certain piece of data or certain areas of the building.
Have you ever walked into a building and saw a sign
that said restricted access, authorized personnel only?
Well, that means you can't go in that area.
It may be something like a maintenance room
or someplace where they have generators
and only the mechanics can get in there.
They have special keys or special badges
that will let them into those areas.
That area is someplace you are not authorized to go.
Kerberos is focused on authentication and authorization.
This is performed through our Kerberos ticketing system
in a Windows domain.
Kerberos is an authentication protocol that provides
for two-way or mutual authentication.
When the user logs onto the domain,
they first contact the domain controller,
which acts as the key distribution center, or KDC.
This KDC has two basic functions,
authentication and ticket granting.
So if your client is authenticated properly,
the KDC will issue them a TGT,
which is called a Ticket Granting Ticket.
This Ticket Granting Ticket is then provided
to the domain controller anytime that user wants
to access a resource,
and then the domain controller can provide that user
with a service ticket or a session key to use,
whichever one's appropriate for their needs.
These tickets are presented to the resource,
and the access is then granted
because the resource always trusts
the domain controllers provided tickets.
Now, because Kerberos relies on the domain controller
to serve as that key distribution center,
this is a single point of failure in the domain.
If the domain controller is down,
ticket-granting services are also shut down.
To prevent this, though, what most people will do
is have a primary and a secondary active domain controller.
That will give you this form of redundancy
to ensure Kerberos is up and LDAP is still running.
The third A is accounting.
Accounting ensures that tracking of data,
computer usage, and network resources is maintained.
Now, when we do that, it's usually put
in something called a log file.
This is a file on a computer
that's essentially just a large text document,
and it keeps track of all sorts of things.
This may be all of the internet connections
that are leaving the network, as shown here on the screen,
or it may be a list of all of the people
who tried to log onto a particular file or website.
All sorts of different logs are kept on your computer
to keep track of all of the various things
that are being done, and this is all
to ensure good accounting practices are being used
because if you have a data breach
or you have some kind of an insider threat,
you can go back and look at the data in your log files
to figure out who did what and when.
That's what accounting allows you to do.
Now, if you have proof that somebody did something,
that they took an action, we call this non-repudiation.
Non-repudiation simply means the user can't say
they didn't take the action because you have proof they did.
For example, if you sent an email to me
and you signed it with a digital signature,
you're the only person in the whole world
who has that private digital signature key.
I know for sure that you sent that email.
You can't tell me later that you didn't send it
because now I have proof.
That's non-repudiation.