authentication

Question 1

Kerberos

Answer 1

port 88

• • ticket granting system
• mutual authentication (client & server)
• no need to re-authenticate (SSO)

–> protection vs. man-in-the-middle / replay attacks

! domain controller can be a single point of failure –> mitigation: primary and secondary domain controller

Question 2

RADIUS

Answer 2

• udp 1812 (auth), 1813 (accounting)
• open standard, AAA server
• used for VPN concentrators

does not support remote access protocol, NetBIOS

Question 3

TACAS+

Answer 3

• port 49 (tcp, more reliable but a bit slower than radius)

Cisco proprietary for N administration, supports all N protocols

provides separate authentication and authorisation functions

Question 4

LDAP

Answer 4

L7 prot for accessing directory services data

Question 5

RADIUS vs TACACS+

Answer 5

RADIUS TACACS+
open standard Cisco only
network access & wifi device administration
UDP 1812/1813 TCP 49
Auth & authorisation are combined A / A / A are separated - more granular control
only pass is encrypted (username is plaintext) // everything is encrypted