Bay Networks 3395A, Configuration Manual

Page: 108 / 146

Model 3395A Server Support for the Xremote Protocol
7-10 893-826-A
Enhancing Security for Xremote Users
The DEFINE PORT XREMOTE ENABLED command enhances security at
communication server ports because it causes the port to bypass the Model
3395A command interface after a user logs in to a port. You can further
enhance security on communication server ports with Xremote enabled, or add
security to ports without Xremote enabled, with these features: a
communication server password, the SecurID authentication system, the
Kerberos security system, and dial-back scripts. This section briefly describes
these features as they apply to Xremote, but for more information about these
features and communication server security in general, see Model 3395/3395A
Software Management Guide.
The Communication Server Password
A communication server password requires a user to enter a predefined
password when the user attempts to log in to a communication server port. The
communication server software does not begin its search for the XDM host
until the user enters the correct password and logs in to the port. To use this
feature, you enable the password requirement at specific ports and specify the
communication server login password. Use the following commands:
DEFINE/SET PORT port-list PASSWORD ENABLED/DISABLED
DEFINE/SET SERVER LOGIN PASSWORD password
The SecurID Authentication System
SecurID is a system of server software, client software, and accompanying
SecurID cards from Security Dynamics Technologies, Inc. The system is
designed to secure a TCP/IP computer network, preventing unauthorized users
from gaining access to resources on a TCP/IP network but allowing authorized
users to gain access easily to these resources.
Using SecurID authentication, the user must specify a SecurID personal
identification number (PIN) and the password (PASSCODE) shown on a
SecurID card in order to log on to the server. Once the user is logged on to the
server, the user can connect to resources on the network. These resources can
also be protected using authentication or other security mechanisms.
The Kerberos Security System
Kerberos is an Internet network authentication service that provides a central
database of encrypted data, such as passwords, that communication servers can
use to verify login requests. A Kerberos system includes a Kerberos master host
and one or more Kerberos server hosts. The master host maintains the database
of encrypted data for a network organization called a realm. The master host
provides data for the server hosts when clients in the realm query the server
hosts for Kerberos verification. The network manager provides Kerberos
passwords for communication server users by entering them on the Kerberos
master host.