Notes - MIECT
Segurança Em Redes De Comunicações
Notes - MIECT
Segurança Em Redes De Comunicações
  • Segurança Em Redes De Comunicações
  • Corporate Networks Topics
    • Objectives of Network Design
    • Equipments
    • Hierarchical Network Model
    • Modular Network Design
    • Designing the Access Layer
    • Designing the Core Layer
    • Virtual LANs
      • VLANs on Access Points
    • Spanning Tree Protocol
    • IP Routing Overview
  • Introduction to Network Security
    • Type of Attacks
    • Attacks Phases
      • Infiltration Phase
      • Propagation Phase
      • Aggregation and Exfiltration Phase
    • Defenses
    • Security Metrics
  • Network Access Control
    • AAA Architecture
      • TACACS+
      • RADIUS
      • DIAMETER
    • IEEE 802.11 services
    • Joining a BSS
      • WLAN Frames
      • Joining BSS with AP
    • WPA and 802.11i (WPA2)
  • Network Flow Control
    • Network Security Systems
    • Firewalls
    • High-Availability
    • Load Balancing Firewall Load
    • Best Practices and Recommendations
    • IP Spoofing
    • Half-Open TCP Connection Problem
    • DDoS Mitigation at Source
    • Cisco’s Access Control Lists (ACL)
    • Linux IPTables
    • Control By Analysis of Higher Layers
  • Secure Communications
    • Public Key Infrastructure (PKI)
    • X.509 Certificate Contents
    • Traffic Tunnel Concept
      • Next Hop Resolution Protocol (NHRP)
      • Hub-Spoke vs. Spoke-Spoke
    • IPSec
    • Establishing SA and Cryptographic Keys
    • Virtual Private Networks (VPN)
    • Management of Asymmetric Keys
  • Remote Access
    • Remote Access
    • IPsec NAT Transversal
    • Integration with Flow Control
  • Intrusion Detection and Prevention
    • Intrusion Detection and Prevention
    • Host-Based vs. Network-Based
    • Signature vs. Anomaly Based
    • Network Deployment
  • Network Monitoring SIEM
    • Core and End-to-End Monitoring
    • Node Monitoring
    • End-User/Host/App Monitoring
    • Server/Service/Cloud Monitoring
    • Per-Service Detailed Monitoring
    • Data Sources
      • SNMP
      • NetFlow
    • Network Passive Probing Packet Capturing
    • Remote CLI Access
    • Log Files Access
      • Log Management Systems (LMS)
      • Security Information and Events Management (SIEM)
Powered by GitBook
On this page
  • Packet
  • Protocol
  1. Network Access Control
  2. AAA Architecture

RADIUS

PreviousTACACS+NextDIAMETER

Last updated 2 years ago

Remote Authentication Dial-In User Service.

The network access device operates as a client of RADIUS.

RADIUS servers are responsible for:

  • Receiving user connection requests.

  • Authenticating the user.

  • Return all configuration information necessary for the client to deliver service to the user.

Transactions between the client and the RADIUS server are authenticated using a shared secret.

Supports a variety of methods to authenticate a user.

  • PAP, CHAP, or MS-CHAP, UNIX login, and other authentication mechanisms.

Combines Authentication and Authorization. Separates Accounting (less flexible than TACACS+).

Uses UDP (less robust).

Unidirectional authentication.

Only encrypts the password (less secure).

RADIUS accounting can hold more information.

Packet

Code - Identifies the type of RADIUS packet.

  • (1) Access-Request,

  • (2) Access-Accept,

  • (3) Access-Reject,

  • (4) Accounting-Request,

  • (5) Accounting-Response,

  • (11) Access-Challenge.

Identifier - Allows the RADIUS client to match a RADIUS response with the correct pending request (usually implemented as a counter).

Authenticator.

  • In client Requests – Random value.

  • In server Responses - MD5 Hash function of (Code, ID, Length, Request Auth, Attributes, Shared Secret).

Attributes - Section where an arbitrary number of attribute fields can be sent.

  • e.g: User-Name and User-Password attributes.

Protocol

Only the password is encrypted.

  • The shared secret followed by the Request Authenticator is put through an MD5 hash to create a 16 octet value which is XORed with the password entered by the user.

  • If the user password is greater than 16 octets, the password is broken into 16-octet blocks and additional MD5 calculations are performed.

The RADIUS protocol has a set of vulnerabilities.

  • The Access-Request packet is not authenticated at all.

  • Many client implementations do not create Request Authenticators that are sufficiently random.

  • Many administrators choose RADIUS shared secrets with insufficient information entropy and many implementations limit the shared secret key space.

RADIUS exchange involving just a username and user password