A long time ago back in the days of dial up.
Now I'm talking about even before PCs we would have big mainframe systems like CompuServe and stuff
like that and people would want to access these services so what they would do is they would sit at
their house with a terminal or whatever it might be and using dial up they would connect to these big
services now that worked fine and they had authentication for example within the system.
You would have usernames and passwords and it could do authentication like chap and stuff like that.
And life was good.
The problem was is that over time we began to have thousands of people tens of thousands hundreds of
thousands of people accessing these systems.
And what you end up having were these big banks of modems that all had to do authentication and that
was a big problem when you had 10000 of these people.
So we needed to come up with a better way to do authentication for the masses.
First of all obviously it had to be centralized.
So what we would do is we'd have some really aligned this up a little bit better.
So here's a person dialing in.
Here's how they're getting into the system.
And then there would be some server back here with all the usernames and passwords.
So didn't matter where the people were connecting they would have one centralized place for the usernames
and passwords.
That's good.
The second thing is we had to handle authorisation better in these types of situations you're just letting
people have access to a system but once they have access to a system what can they do within the system
and with pure authentication you didn't even have that feature.
Third was accounting.
We had to keep track of what people were doing and when in order to understand what was taking place
in order to stand to deal with problems.
So we needed to come up with a complete system that took care of authentication authorization and accounting.
And those are known generically as triple-A.
Now there are two very different ways to do that well not that different.
We have a lot of similarity and they're called radius and to Cacace.
So let's take a look at both.
First let's talk about remote authentication dial in user service better known as radius.
Now this is a radius setup.
Now keep in mind that radius based on its name was designed to support dial in networking so the main
parts of radius are going to look like this.
First of all you're going to have a radius server.
Now this radius server is sitting inside whatever network or system you're trying to get to on this
system are going to be a bunch of usernames and passwords.
Now these can be stored by themselves.
These could be a sequel database.
This could be a Active Directory domain.
It doesn't really matter where the usernames and passwords are in fact they don't even have to physically
sit on the server.
The server himself simply has to be able to get to that stack of usernames and passwords and then he
can go ahead and authenticate on that.
The next part is going to be what we call the radius client the radius client is not really the person
who's trying to get authenticated the radius client is really the gateway that separates that which
we want to get authenticated from from those who are trying to get authenticated way on the end.
Here is the radius supplicant a supplicant is the person the system whatever it is that's actually trying
to get authenticated.
So this is the basic setup for radio.
So what will happen is that this device will go to the radius client and then the radius client knows
the IP address of the radius server sends the credentials over and the radius server decides whether
that person can be authenticated or not.
Now dialups long dead no doubt about that.
But radious lives on well in the world of wireless networks.
If you want serious authentication in a wireless network I'm not talking about WPA to personal shared
key and stuff like that you would use a radius server.
Every wireless network in the world is designed to support radious servers so to do this you end up
having to buy a radius server.
Juniper cell steel belted radius.
Microsoft sells Internet authorisations server.
You can get open radious which is a Linux based tool.
Configure this.
You then go into your wireless access points and pretty much every wireless access point in existence
has a setting in there that says yes I want to use radius and all you do here is type in the IP address
for this guy it then these guys don't even really see any of this happening.
They would have to enter a username and password which could be done automatically but they do have
to go through that process.
So when you're talking about radious there's two things I want you to remember.
Number one radius is really used more for network access than anything else.
Secondly you need to remember that radious can use up to four different UDP ports 1 8 1 2 1 8 1 3 1
6 4 5 and 1 6 4 6.
Now I want to add one more thing while I'm at it.
The downside if you want to call it that radius is radious doesn't really handle authorization.
It gets you authenticated just fine.
But the whole idea behind accessing the network is that it lets you get in and then there's other stuff
later like Domain Controllers and stuff like that that will actually decide what you get to do.
But we're going to see with the next one that that can sometimes be an issue.
Next let's talk about terminal access control or access control system better known as to Cacace.
Plus now to Cacace Plus is also a form of Triple A but it does a few things that are very different.
In particular to Kaka's plus is really really good at managing a bunch of devices.
So if you've got a bunch of routers and switches and stuff all over the place and people have to log
into them to be able to do stuff with them to Cacace Plus is where you go.
Now in this situation what I have are a bunch of Cisco devices these are different Cisco switches and
routers and I've got somebody over here who wants to access these remotely so he's going to use S-sh
or something like that to get into them.
Now the challenge you have in these types of situations is that authentication isn't that bad and to
Cacace has to hack a server but we're Cacace really shines over radios.
Is that to Cacace really takes care of the authorization aspect really well see if you talk about what's
happening on these little switches and routers is that it really depends on who you are that you want
to determine what they can do.
So to Cacace we say decouples the authentication from the authorization with radius it's all kind of
done in one big lump.
You're either you're in or you're not in but with the Cacace not only are you in but it also defines
in real time what you can do with these individual devices.
Here I have tens of thousands of unique individual commands that I can send to them.
But the trick is is that I may not want everybody to view certain groups or commands that I want to
have certain groups to do certain stuff and that is where to Kaka's plus really shines because it decouples
the authorization from the authentication.
Oh and by the way for the security plus make sure you know that to Cacace Plus uses TZP port 49.
So those are the two big differences between the two most popular versions of Triple A radius and to
Cacace plus.
Now the one thing that they both do really really well is auditee.
They can actually go through auditing accounting.
Really the last days the same either way they can go through and keep track of who's doing what when
they're doing it.
They generate log files.
And that's really what the third part of Triple-A is all about.
Make sure you know all this stuff because you know what it's on security plus.