Authentication systems

Authentication systems

1. A lot of protocols include authentication. You provide a password, or a certificate, or whatever, and you can access the web page, email account, or remote system.

   • Other authentication systems can control who logs onto the network in the first place, or provide single sign-on capabilities letting a user provide authentication once and access all authorized services across the network.

2. RADIUS: Designed for dialup connections to private LANs, but widely used in other networks, Remote Authentication Dial-In User Service authenticates users when they attempt to connect to the network.

   • RADIUS uses a variety of UDP ports depending on implementation.

3. TACACS+: Terminal Access Controller Access-Control System Plus is a proprietary Cisco protocol with similar functions to RADIUS.

   • It was designed for remote administration of network devices but can be used for remote access authentication as well. Compared to RADIUS it has some security and flexibility benefits, but is proprietary and more resource intensive.

4. Kerberos: Allows a client to access multiple network resources via a single sign-in. Used by a number of network systems, including Windows domain networks.

5. 802.1X: An IEEE standard Used to authenticate connections to an Ethernet switch or wireless access point. It's the protocol used by Wi-Fi hotspots operating in Enterprise mode. 802.1X servers commonly use RADIUS servers for back-end authentication.

6. LDAP: Lightweight Directory Access Protocol manages distributed directory information services across a network. It's used by many directory service systems from multiple vendors, such as Novel's eDirectory and Microsoft's Active Directory.

   • LDAP allows clients to query a central network database for information about user accounts, printers, and other network resources.
   • LDAP by default uses TCP port 389 and has limited security features LDAP over SSL (LDAPS) uses TCP port 636; it has security features, but is still more suited to trusted LANs than the Internet.