Black Box LE2101A-BT-R2, Руководство пользователя

Страница: 89 / 236

89
TERMINAL SERVERS
• PAP—Password Authentication Protocol is used to authenticate user on
the same principle as the standard login. The client authenticates itself to
the server by sending a user name (and optionally a password) to the
server. The server then compares it with its hidden database. The
Terminal Server checks the data in its RADIUS server database (see
Authentication—Using Radius).
• CHAP—Challenge-Handshake Authentication Protocol is used to
authenticate users using challenge-response schemes, thereby preventing
the unwanted capture of user name and password. The server sends a
randomly generated challenge string to the client, along with its
hostname. The client uses the hostname to look up an appropriate key,
combines this with the challenge and encrypts it with a special algorithm.
The resulting string is returned to the server along with the client
hostname.
The server then performs the same computation, as the client, on the
challenge string. The server only permits the client to connect if the results
are identical.
An additional security feature of CHAP is that the client authentication is
not only required at the initial connect time, but the server also sends
challenge strings to the client at regular intervals to detect if the client has
been replaced by an imposter. The following example shows how to add PAP
capability to an already defined PPP port.
1 Local> DEFINE PORT 5 PPP LCP AUTHENTICATION PAP
2 Local> DEFINE PORT 5 AUTHENTICATION ENABLE
Figure 4-32. PPP with Authentication.
Statement 1 configures the port to use PPP PAP protocol. The node must
send a valid user name and password using the PPP PAP protocol.
4.15 Accounting Using RADIUS
Accounting of the Terminal Server is available only when using the RADIUS
protocol. The accounting data is recorded on a RADIUS accounting server.