Upload
others
View
8
Download
0
Embed Size (px)
Citation preview
FIREWALLS & NETWORK SECURITY with
Intrusion Detection and VPNs, 2nd ed.
Chapter 10 Authenticating Users
Learning Objectives
Explain why authentication is a critical aspect of network security
Explain why firewalls authenticate and how they identify users
Describe user, client, and session authentication
List the advantages and disadvantages of popular centralized authentication systems
Discuss the potential weaknesses of password security systems
Discuss the use of password security tools
Describe common authentication protocols used by firewalls
Slide 2 Firewalls & Network Security, 2nd ed. - Chapter 10
The Authentication Process in General
The act of identifying users and providing
network services to them based on their identity
Two forms
– Local authentication
– Centralized authentication service (often uses
two-factor authentication)
Slide 3 Firewalls & Network Security, 2nd ed. - Chapter 10
How Firewalls Implement the
Authentication Process
1. Client makes request to access a resource
2. Firewall intercepts the request and prompts the user for name and password
3. User submits information to firewall
4. User is authenticated
5. Request is checked against firewall’s rule base
6. If request matches existing allow rule, user is granted access
7. User accesses desired resources
Slide 4 Firewalls & Network Security, 2nd ed. - Chapter 10
How Firewalls Implement the
Authentication Process (continued)
Slide 5 Firewalls & Network Security, 2nd ed. - Chapter 10
Firewall Authentication Methods
User authentication
Client authentication
Session authentication
Slide 6 Firewalls & Network Security, 2nd ed. - Chapter 10
User Authentication
Basic authentication; user supplies username
and password to access networked resources
Users who need to legitimately access your
internal servers must be added to your access
control lists (ACLs)
Slide 7 Firewalls & Network Security, 2nd ed. - Chapter 10
User Authentication (continued)
Slide 8 Firewalls & Network Security, 2nd ed. - Chapter 10
Client Authentication
Same as user authentication but with additional
time limit or usage limit restrictions
When configuring, set up one of two types of
authentication systems
– Standard sign-on system
– Specific sign-on system
Slide 9 Firewalls & Network Security, 2nd ed. - Chapter 10
Client Authentication (continued)
Slide 10 Firewalls & Network Security, 2nd ed. - Chapter 10
Session Authentication
Required any time the client establishes a
session with a server of other networked
resource
Slide 11 Firewalls & Network Security, 2nd ed. - Chapter 10
Comparison of Authentication Methods
Slide 12 Firewalls & Network Security, 2nd ed. - Chapter 10
Centralized Authentication
Centralized server maintains all authorizations
for users regardless of where user is located
and how user connects to network
Most common methods
– Kerberos
– TACACS+ (Terminal Access Controller Access
Control System)
– RADIUS (Remote Authentication Dial-In User
Service)
Slide 13 Firewalls & Network Security, 2nd ed. - Chapter 10
Process of Centralized Authentication
Slide 14 Firewalls & Network Security, 2nd ed. - Chapter 10
Kerberos
Provides authentication and encryption through standard clients and servers
Uses a Key Distribution Center (KDC) to issue tickets to those who want access to resources
Used internally on Windows 2000/XP
Advantages
– Passwords are not stored on the system
– Widely used in UNIX environment; enables authentication across operating systems
Slide 15 Firewalls & Network Security, 2nd ed. - Chapter 10
Kerberos Authentication
Slide 16 Firewalls & Network Security, 2nd ed. - Chapter 10
TACACS+
Latest and strongest version of a set of authentication protocols for dial-up access (Cisco Systems)
Provides AAA services
– Authentication
– Authorization
– Auditing
Uses MD5 algorithm to encrypt data
Slide 17 Firewalls & Network Security, 2nd ed. - Chapter 10
RADIUS
Centralized dial-in authentication service that
uses UDP
Transmits authentication packets unencrypted
across the network
Provides lower level of security than TACACS+
but more widely supported
Slide 18 Firewalls & Network Security, 2nd ed. - Chapter 10
TACACS+ and RADIUS Compared
Strength of security
Filtering characteristics
Proxy characteristics
NAT characteristics
Slide 19 Firewalls & Network Security, 2nd ed. - Chapter 10
Strength of Security
Slide 20 Firewalls & Network Security, 2nd ed. - Chapter 10
Filtering Characteristics
Slide 21 Firewalls & Network Security, 2nd ed. - Chapter 10
Proxy Characteristics
RADIUS
– Doesn’t work with generic proxy systems, but a
RADIUS server can function as a proxy server
TACACS+
– Works with generic proxy systems
Slide 22 Firewalls & Network Security, 2nd ed. - Chapter 10
NAT Characteristics
RADIUS
– Doesn’t work with NAT
TACACS+
– Should work through NAT systems
Slide 23 Firewalls & Network Security, 2nd ed. - Chapter 10
Password Security Issues
Passwords that can be cracked (accessed by
an unauthorized user)
Password vulnerabilities
Lax security habits
Slide 24 Firewalls & Network Security, 2nd ed. - Chapter 10
Passwords That Can Be Cracked
Ways to crack passwords
– Find a way to authenticate without knowing the password
– Uncover password from system that holds it
– Guess the password
To avoid the issue
– Protect passwords effectively
– Observe security habits
Slide 25 Firewalls & Network Security, 2nd ed. - Chapter 10
Password Vulnerabilities
Built-in vulnerabilities
– Often easy to guess
– Often stored visibly
– Social engineering
To avoid the issues
– Choose complicated passwords
– Memorize passwords
– Never give passwords out to anyone
Slide 26 Firewalls & Network Security, 2nd ed. - Chapter 10
Lax Security Habits
To maintain some level of integrity, draw up a
formal Memorandum of Understanding (MOU)
Slide 27 Firewalls & Network Security, 2nd ed. - Chapter 10
Password Security Tools
One-time password software
Shadow password system
Slide 28 Firewalls & Network Security, 2nd ed. - Chapter 10
One-Time Password Software
Password is generated using a secret key
Password is used only once, when the user authenticates
Different passwords are used for each authentication session
Types
– Challenge-response passwords
– Password list passwords
Slide 29 Firewalls & Network Security, 2nd ed. - Chapter 10
Shadow Password System
A feature of Linux that stores passwords in
another file that has restricted access
Passwords are stored only after being
encrypted by a randomly generated value and
an encoding formula
Slide 30 Firewalls & Network Security, 2nd ed. - Chapter 10
Other Authentication Systems
Single-password systems
One-time password systems
Certificate-based authentication
802.1x Wi-Fi authentication
Slide 31 Firewalls & Network Security, 2nd ed. - Chapter 10
Single-Password Systems
Operating system password
Internal firewall password
Slide 32 Firewalls & Network Security, 2nd ed. - Chapter 10
One-Time Password Systems
Single Key (S/Key)
SecurID
Axent Pathways Defender
Slide 33 Firewalls & Network Security, 2nd ed. - Chapter 10
Single Key (S/Key)
Uses multiple-word rather than single word passwords
– User specifies single-word password and the number of times it is to be encrypted
– Password is processed by a hash function n times; resulting encrypted passwords are stored on the server
Never stores original password on the server
Slide 34 Firewalls & Network Security, 2nd ed. - Chapter 10
SecurID
Uses two-factor authentication
– Physical object
– Piece of knowledge
Most frequently used one-time password
solution with FireWall-1
Slide 35 Firewalls & Network Security, 2nd ed. - Chapter 10
SecurID Tokens
Slide 36 Firewalls & Network Security, 2nd ed. - Chapter 10
Axent Pathways Defender
Uses two-factor authentication and a challenge-
response system
Slide 37 Firewalls & Network Security, 2nd ed. - Chapter 10
Certificate-Based Authentication
FireWall-1 supports the use of digital certificates
to authenticate users
Organization sets up a public key infrastructure
(PKI) that generates keys to users
– User receives a code (public key) that is
generated using the server’s private key and
uses the public key to send encrypted
information to the server
– Server receives the public key and can decrypt
the information using its private key
Slide 38 Firewalls & Network Security, 2nd ed. - Chapter 10
802.1x Wi-Fi Authentication
Supports wireless Ethernet connections
Not supported by FireWall-1
802.1x protocol provides for authentication of
users on wireless networks
Wi-Fi uses Extensible Authentication Protocol
(EAP)
Slide 39 Firewalls & Network Security, 2nd ed. - Chapter 10
Wireless Authentication
Slide 40 Firewalls & Network Security, 2nd ed. - Chapter 10
Chapter Summary
Overview of authentication and its importance to
network security
How and why firewalls perform authentication
services
Types of authentication performed by firewalls
– User
– Client
– Session
Slide 41 Firewalls & Network Security, 2nd ed. - Chapter 10
Chapter Summary (continued)
Generally, users supply:
– Something they have (such as a smart card) or
– Something they know (such as a password) or
– Both
Latest authentication systems measure or evaluate a physical attribute, such as a fingerprint or voiceprint
Slide 42 Firewalls & Network Security, 2nd ed. - Chapter 10
Chapter Summary (continued)
In a centralized authentication system:
– Firewall works with an authentication server
– Authentication server handles
• Username and password maintenance/generation
• Login requests
• Auditing
Examples of centralized authentication systems:
– Kerberos
– TACACS+
– RADIUS
Firewalls & Network Security, 2nd ed. - Chapter 10 Slide 43
Chapter Summary (continued)
Passwords
– Important part of virtually every authentication system
– Take one of two general forms:
• Single-word
– User password compared against database of passwords; access granted if match is made
– Vulnerable to ability of hackers to determine passwords, to user error, and to bad security habits
• One-time passwords
– Generated dynamically each time user attempts to log on to network
– Secret key used to generate single- or multiple-word password
Firewalls & Network Security, 2nd ed. - Chapter 10 Slide 44