Companies are moving to the remote node, remote LAN, and remote access server paradigm because it increases user productivity. Remote node technology gives users access to the same corporate network from home or while traveling as they do at work. Connecting to the network means connecting to a NetWare file server or AppleShare. Users are not required to become experts on terminal services and login prompts.
Since the network is now readily available through remote node technology, network access security has become increasingly important. Host security was adequate for terminal access, but network access security is needed for remotely connected users or remote nodes.
However, once users are authenticated to use the LAN, they may still need to apply a username password for access to specific services such as UNIX hosts, NetWare, or AppleShare. A good NAS server supports a variety of authentication options.
Authorization allows users to be mobile. Mobile and temporary users (portable users with modems in hotels and telecommuters with modems or ISDN connections at home) want to connect to the closest local connection and still have the same access privileges of their local networks.
The network administrator must be able to limit network access to users for all access protocols and services (Telnet, IP, IPX, and AppleTalk) while users dial in through the same modem pool. Per-user access list authorization is not limited to specific interfaces but is dynamically assigned to the specific port to which a user attaches. For example, when user A connects to port 1, she can see subnets 1, 2, 3 and AppleTalk zones bldg D, bldg E, and bldg F. When user B connects to port 1, his profile limits him to subnet 1 and AppleTalk zone bldg D.
Since a NAS supports many more remote users than its physical lines, each user or group of users can dial into the same phone rotary and receive access to the network. The access list is based on username and, as such, each NAS, and can support thousands of users in its username and password database.
----------------------------------------------------------------------------- FEATURE FUNCTION ============================================================================= Username and password Basic NAS securityPer-user access Basic authentication lists for IP
Callback Reverses phone charges, extra security for telecommuters
PAP and CHAP Translates PAP or CHAP to TACACS
Logging Sends start and stop times to external logging server
Absolute time out Limits the time a user can be connected to connect session limit
Inactivity time out Cisco supports session timeout, which disconnects a user after a specified time of inactivity. After a session timeout, another person cannot use the connection.
Autocommand A user can automatically execute a command (if it is available in the internal database).
System script Automatically connects a user to a specific host or other script capabilities
Autoselect Automatically provides users with the service they need to connect to the access server. Autoselect supports Telnet, TN3270, SLIP, PPP (for IP or IPX) and ARA. Autoselect limits the user's access to services by automatically providing the appropriate service. For example, a Macintosh user can be automatically dropped into ARA without an exec terminal session. This is both a security and ease- of-use feature. -----------------------------------------------------------------------------
Users connected to EXEC may specify various services: UUCP, PPP, SLIP, ARA, TN3270, Telnet, or EXEC to manage the router itself.
Connecting to EXEC allows users to manage the access server or router if they have the appropriate privileges.
Cisco implemented the Terminal Access Controller Access System (TACACS) protocol for this exact reason. It was developed by BBN to support multiple communication servers' username/password authentication. It forwards the user's username and password information to a centralized database that also has the TACACS protocol. The centralized database looks up the information and sends back an accept or deny message, which either allows or denies the user access. The centralized database can be modified to control the authorization from either a simple or complex environment.
A security protocol and server are much more extendible and scalable for large enterprises. TACACS and other remote access security protocols are designed to support thousands of remote connections. In a large network, the user database is usually large, and is best kept on a centralized server. This saves memory in all the access devices and eliminates the need to update every access server when new users are added, or passwords are modified or changed.
XTACACS supports:
XTACACS is multiprotocol and can authorize connections with:
Figure 1: Control Access to Network Via Dial Up
TACACS+ will be supported by the Cisco family of routers and access servers as part of a maintenance of Cisco IOS Release 10.3. This protocol is a completely new version of the TACACS protocol referenced by RFC 1492. Cisco is presenting TACACS+ to the IETF working groups and will contribute to and adopt the emerging NAS protocol standard.
The overall design goal of TACACS+ is to define a standardmethod for managing dissimilar Network Access Servers (NASs) from a single set of management services such as a database. A NAS provides connections to a single user, to a network, or subnetwork, and interconnected networks.
TACACS+ has three major components: the protocol support within the access servers and routers, the protocol specification, and the centralized security database. Similar to an internal security database, TACACS+ supports the following three required features of a good security system.
Authentication
The TACACS+ protocol forwards many types of username password information. This information is encrypted over the network with MD5, an encryption algorithm. TACACS+ can forward the password types for ARA, SLIP, PAP, CHAP, and standard Telnet. This allows clients to use the same username password for different protocols. TACACS+ is extensible to support new password types like KCHAP.
TACACS+ authentication supports multiple challenge and response demands from the TACACS+ server. This allows token card vendors to provide advanced features like sending back a second token-generated number after the first one was manipulated by a security server.
Authorization
TACACS+ provides a mechanism to tell an access server which access list that a user connected to port 1 uses. The TACACS+ server and location of the username/password information identify the access list through which the user is filtered. The access list(s) reside on the access server. The TACACS server responds to a username with an accept and an Access List number which causes that list to be applied.
Accounting
TACACS+ provides accounting information to a database through TCP to insure a more secure and complete accounting log.
The accounting portion of the TACACS+ protocol contains the network address of the user, the username, the service attempted, protocol used, time and date, and the packet-filter module originating the log. For Telnet connections, it also contains source and destination port, action carried (communication accepted, rejected), log, and alert type. Formats are open and configurable.
The billing information includes connect time, user ID, location connected from, start time, and stop time. It identifies the protocol that the user is using and may contain commands being run if the users are connected through exec and Telnet.
Future TACACS+ accounting enhancements will provide connect time updates, which will send an update for current connect time to the accounting server every x minutes. This feature allows companies like Internet providers to bill a customer for an open session even if the access server restarts and loses the initial start time. Service providers can significantly minimize lost billing time.
The auditing information provides which commands + arguments, location connect from.
The protocol provides enough information so that a server can produce intruder detection routines, reporting statistics, number of packets, and number of bytes.
Users want servers to prevent multiple uses of the same username/password so that customers with flat rates do not share their account with others. Although the decision to give access is made on the server, the protocol is flexible enough to provide the necessary information to detect multiple passwords.
Figure 2: TACACS and Token Card Support
Companies that support this solution today include:
Advantages of the TACACS+ Protocol:
Authentication provides complete server control of the authentication process, which includes:
Authorization allows "remote" access control and enhanced granularity. Features include:
The authentication protocol can also generate an autocommand. Once a user is authenticated, this runs any command within the access server system and is very powerful for complete access management. Network managers can use the accounting component to track user activity for a security audit trail or to provide billing information. A report might be structured to provide: user identity, start and stop times, executed commands, number of packets, and number of bytes.
Password aging is another example of the capabilities that are now available with TACACS+. A server supporting TACACS+ can send a message back to users, telling them to change their passwords as part of the login sequence. They will not be allowed access unless they change their passwords at that time.
-----------------------------------------------------------------------------
TACACS
FEATURE INTERNAL XTACACS TACACS+
=============================================================================
AUTHENTICATION
PAP/CHAP * * *
System script * * *
Autocommand * * *
DialBack 95 * 95
Username/password * * *
Use MD5 encryption *
Token card support * *
Via Kerberos 5 95
For exec * * *
For PPP (IP and IPX) * * *
For ARA * * *
Multiple challenge and response *
Router access authentication * * *
Support for rcmd *
Try multiple authentication types * *
-----------------------------------------------------------------------------
AUTHORIZATION * *
Per user-IP (SLIP and PPP) * * *
Per user IPX 95 95 95
Per user ARA 95 95 95
exec prompt access * *
exec and PPP IP address * *
exec and Telnet * * *
Router commands * * *
User-changeable Dependent on Yes, but only
password server with one server
-----------------------------------------------------------------------------
ACCOUNTING
Time connection start * *
Time connection finish * *
Total connection time * *
# packets, # bytes
Which commands + argument 95
Location connect from 95
User ID * *
User protocol * *
Use UDP *
Use TCP *
Absolute time out
Inactivity time out
-----------------------------------------------------------------------------
Third-party token support will be enhanced with TACACS+ in that the custom database will be able to handle challenge response mechanisms for tokencards and other advanced authentication systems.
Cisco is working with the IETF to standardize these security protocols. And is working with other centralized security protocols like Radius. Cisco will participate in the evolution of a single standards-based NAS protocol.