5.1 Receiver With Hdmi Upconversion Hdmi

Configuring AAA on a router

1. The functions and importance of AAA.

• Authentication: verifies that users and administrators to be who they seem.
• Authorization: After authenticating the user or administrator, decide what resources can be accessed and what operations can be performed.
• Register (Accounting and Auditing): save the point in time in which operations are carried out and access to resources.
  

2. The three methods to implement AAA.

Users can access the LAN the company through dial (NAS) or through a VPN (router, ASA). Administrators can access the network devices via the console port, auxiliary port or vty.

All these forms of access can be implemented with AAA either locally or in remote DB. With remote DB we can centralize the management of AAA of various network devices.
The three methods implemented AAA are:

• Locally: In a router or a NAS.
• In an ACS (Access Control Server) in Cisco software, installed on a Microsoft Windows Server enabling communication with routers and NAS.
• A Cisco ACS hardware, dedicated hardware server allowing communication with routers and NAS.
  

3. Remote authentication methods.

There are two methods to authenticate remote users, local or remote authentication.

• 
  
local authentication is to authenticate

directly into the router or NAS user names and passwords. Is recommended for small networks and requires no external DB.
authentication works as follows: the user requests authentication, the router (or NAS) is requesting the user name and password, the user responds, the router checks the data, accepts or denies access and the user communicates the verdict . Remote Authentication

• 
  

The local authentication problem is scalability. One or more ACS (software or hardware) can handle all authentication of all network devices. Communication between these devices and the ACS uses the following protocols: TACACS + or RADIUS.

authentication works as follows: the user requests authentication, the router (or NAS) is requesting the user name and password, the user responds, the router forwards the data to the ACS, the ACS checks the data and accepts or refused access, the ACS announced finally the verdict to the router and the user.

4. Protocols TACACS + and RADIUS.

ACS supports Cisco TACACS + and RADIUS protocols. TACACS + is safer but RADIUS Accounting has better and better programming interface.
ACS to manage the following shortcuts:

• dialing into a router or a NAS. Ports
• console and auxiliary ports vtys network devices.
• ASAs (Adaptive Security Appliance).
• series VPN concentrators 300 (RADIUS only).
• Some token cards (token cards) and servers
  

5. The security levels of authentication methods.

• No username and password: an attacker should only find the device and try to access it. One way to ensure that the service would hear a different port.
• user name and password with no expiration, the administrator decides when to change your password. This method is vulnerable to replay attacks, brute force, theft and inspection of packages.
• with username and password and expiration: each x time the administrator is forced to change your password. This method has the same vulnerabilities, but the time to compromise the computer is less than brute force.
• OTPs: it is safer than the previous because the password sent is valid only one time, ie, at the time of being intercepted by the attacker's password expires. S / Key OTP is an implementation that generates a list of passwords from a secret word.
• Cards witness in software and hardware, is based on two-factor authentication: something the user has (token card) and something the user knows (PIN card token). There are two types: time-based, F (clave_criptográfica, PIN) = OTP-based or challenges; F (challenge clave_criptográfica) = OTP.
  

6. PPP authentication protocols.

PPP supports PAP, CHAP and MS-CHAP. PAP uses
exchange two-way, the authenticator requests the user credentials and sends them in clear text. The exchange came after establishing the PPP link.
CHAP uses a three-way exchange, after establishing the link, the authenticator sends a challenge to the user device, it responds with a hash, F (challenge palabra_secreta) = hash, the Authenticator verifies that the received hash matches your computed hash. This three-way exchange is repeated periodically (controlled by the authenticator) for communication and prevents replay attacks.
MS-CHAP is the Microsoft version of CHAP.

7. Configuring AAA on a router.

First AAA model enabled, we add a local user and define the remote access authentication locally.

  Router (config) # aaa new-model 
 Router (config) # username secret tracker 
 CCSP Router (config) # aaa authentication login default local  
 

Now we have no trouble re-access the router or NAS in If you lose communication (SSH).

then define the methods of authentication for login (access router), ppp and enable (privileged level access) and apply a line level or interface:

  Router (config) # aaa authentication login default enable 
 Router (config) # enable secret  cisco 
 Router(config)#aaa authentication login consola local 
 Router(config)#line console 0 
 Router(config-line)#login authentication consola 
 Router(config)#aaa authentication login vty line 
 Router(config)#line vty 0 4 
 Router(config-line)#password 123telnet 
 Router(config-line)#login authentication vty 
 Router(config-line)#end 
 Router#exit 
 Router con0 is now available 
 Press RETURN to get started. 
 User Access Verification 
 Username: tracker 
 Password: ccsp 
 Router> 
  
 R1#Router 
 Trying Router (192.168.0.1)... Open 
 User Access Verification 
 Password: 123telnet 
 Router>enable 
 Password: cisco Router # 
  
 

In the above commands, we have defined that to access the router must be used by default (default) password "enable secret" which to access the console you have to use a name local username and password (tracker: CCSP) and telnet to access the password need 123telnet online. Playlists particles authentication (console and vty) when applied to lines (vty, console, aux) or interfaces takes precedence over the default authentication (default).

Now define a list of default PPP authentication (default) and a particular (tagging) that apply:

  Router (config) # aaa authentication ppp default local 
 Router (config) # aaa authentication ppp dialing group tacacs + local-case 
 Router (config) # interface serial 0 / 0 
 Router (config-if) # ppp authentication chap tagging  
 

Above we defined the default PPP authentication is local and the particular PPP authentication (dial) or with TACACS + and if local failure is considering case-sensitive. Finally

define that authentication enable default group RADIUS look first and then the password "enable secret ':

  Router (config) # aaa authentication enable default enable group radius  
 

Now we will see some examples of authorization and accounting (accounting):

  Router (config) # aaa local Authorization 
 commands 15 default Router (config) # aaa local netop Authorization network 
 Router (config) # aaa accounting commands 15 default stop-only group tacacs +  
 

The first command authorizes the implementation of local-level commands 15 using the default list (default). The second authorizes locally some network services using a list (netop). The third recorded commands remotely using TACACS + level 15 for the list by default.

8. Troubleshooting AAA on a router.

  Router # debug aaa authentication debug aaa 
 Authorization Router # Router # debug aaa 
 accounting  
 

9. Configuring AAA Using Cisco SDM.

AAA can also be configured from SDM. We use

 command aaa new-model   

in the SDM and choose 'Additional Tasks> AAA'. You will see a screen to list, edit and delete methods of authentication on the router.

Source: #. / Hacktracking