86
TERMINAL SERVERS
A typical description of such a process involves the following:
• Using a modem, the user dials-in to a modem connected to the Terminal
Server. Once the modem connection is completed, the Terminal Server
prompts the user for a name and password.
• The Terminal Server creates a data packet from this information called
the authentication request. This packet includes information identifying
the specific access server sending the authentication request, the port that
is being used for the modem connection, and the user name and
password. For protection from eavesdropping hackers, the Terminal
Server, acting as a RADIUS client, encrypts the password before it is sent
on its journey to the RADIUS server.
• The Authentication Request is sent over the network from the RADIUS
client to the RADIUS server. This communication can be done over a
local or wide-area network, allowing network managers to locate RADIUS
clients remotely from the RADIUS server. If the RADIUS server cannot be
reached, the RADIUS client can route the request to an alternate server.
• When an Authentication Request is received, the Authentication Server
validates the request and decrypts the data packet to access the user name
and password information. This information is passed on to the
appropriate security system being supported (either UNIX password files
or Kerberos, a commercially available security system or even a custom
developed security system).
• If the user name and password are correct, the server sends an
Authentication Acknowledgement that includes information on the user’s
network system and service requirements. For example, the RADIUS
server will tell the access server that a user needs TCP/IP using PPP
(Point-to-Point Protocol) or that the user needs SLIP (Serial Line
Internet Protocol) to connect to the network. The acknowledgement can
even contain filtering information to limit a user’s access to specific
resources on the network.
• If at any point in this log-in process conditions are not met, the RADIUS
server sends an Authentication Reject to the access server and the user is
denied access to the network.
• To ensure that requests are not responded to by unauthorized hackers
on the network, the RADIUS server sends an authentication key, or
signature, identifying itself to the Terminal Server. Once this information
is received by the Terminal Server, it enables the necessary configuration
to deliver the right network services to the user.
Summary of Contents for LE2101A-BT-R2
Page 2: ......
