PART III in Software

Draw QR Code JIS X 0510 in Software PART III

As with the two previous services, accounting is also an optional function of TACACS+ When utilized, it typically follows the other services Accounting in TACACS+ is defined as the process of recording what a user or process has done Accounting can serve two important purposes: It can be used to account for services being utilized, possibly for billing purposes It can be used for generating security audit trails TACACS+ accounting records contain several pieces of information to support these tasks The accounting process has the information revealed in the authorization and authentication processes, so it can record specific requests by user or process To support this functionality, TACACS+ has three types of accounting records: START, STOP, and UPDATE Note that these are record types, not message types as earlier discussed START records indicate the time and user or process that began an authorized process STOP records enumerate the same information concerning the stop times for specific actions UPDATE records act as intermediary notices that a particular task is still being performed Together these three message types allow the creation of records that delineate the activity of a user or process on a system

Layer Two Tunneling Protocol (L2TP) and Point-to-Point Tunneling Protocol (PPTP) are both OSI layer two tunneling protocols Tunneling is the encapsulation of one packet within another, which allows you to hide the original packet from view or change the nature of the network transport This can be done for both security and practical reasons From a practical perspective, assume that you are using TCP/IP to communicate between two machines Your message may pass over various networks, such as an Asynchronous Transfer Mode (ATM) network, as it moves from source to destination As the ATM protocol can neither read nor understand TCP/IP packets, something must be done to make them passable across the network By encapsulating a packet as the payload in a separate protocol, so it can be carried across a section of a network, a mechanism called a tunnel is created At each end of the tunnel, called the tunnel endpoints, the payload packet is read and understood As it goes into the tunnel, you can envision your packet being placed in an envelope with the address of the appropriate tunnel endpoint on the envelope When the envelope arrives at the tunnel endpoint, the original message (the tunnel packet s payload) is re-created, read, and sent to its appropriate next stop The information being tunneled is understood only at the tunnel endpoints; it is not relevant to intermediate tunnel points because it is only a payload PPP is a widely used protocol for establishing dial-in connections over serial lines or Integrated Services Digital Network (ISDN) services PPP has several authentication mechanisms, including PAP, CHAP, and the Extensible Authentication Protocol (EAP) These protocols are used to authenticate the peer device, not a user of the system PPP is a standardized Internet encapsulation of IP traffic over point-to-point links, such as serial lines The authentication process is performed only when the link is established

Microsoft led a consortium of networking companies to extend PPP to enable the creation of virtual private networks (VPNs) The result was PPTP, a network protocol that enables the secure transfer of data from a remote PC to a server by creating a VPN across a TCP/IP network This remote network connection can also span a public switched telephone network (PSTN) and is thus an economical way of connecting remote dial-in users to a corporate data network The incorporation of PPTP into the Microsoft Windows product line provides a built-in secure method of remote connection using the operating system, and this has given PPTP a large marketplace footprint For most PPTP implementations, three computers are involved: the PPTP client, the NAS, and a PPTP server, as shown in Figure 9-3 The connection between the remote client and the network is established in stages, as illustrated in Figure 9-4 First the client makes a PPP connection to a NAS, typically an ISP Once the PPP connection is established, a second connection is made over the PPP connection to the PPTP server This second connection creates the VPN connection between the remote client and the PPTP server This connection acts as a tunnel for future data transfers Although these diagrams are drawn illustrating a telephone connection, this first link can be virtually