Filter
Top Products
Introduction to AAA Server
RADIUS Overview
Chapter 1 5
Accounting-Request—triggered by the user, by the client, or an interruption in service—to
stop the session. Again, the server will acknowledge the Accounting-Request with an
Accounting-Response.
Supported Authentication Methods
The following list describes the authentication methods the HP-UX AAA Server supports:
Password Authentication Protocol (PAP)
Not a strong authentication method to establish a connection; passwords are sent in clear text
between the user and client. When used with RADIUS for authentication, the messages
exchanged between the client and server to establish a PPP connection corresponds to
Figure 1-2. This authentication method is most appropriately used where a plaintext
password must be available to simulate a login at a remote host. In such use, this method
provides a similar level of security to the usual user login at the remote host.
Challenge Handshake Authentication Protocol (CHAP)
A stronger authentication protocol to establish a connection. When used with RADIUS for
authentication, the messages exchanged between the client and server to establish a PPP
connection is similar to Figure 1-2. One difference, however, is that a challenge occurs
between the user and NAS before the NAS sends an Access-Request. The user must respond
by encrypting the challenge (usually a random number) and returning the result. Authorized
users are equipped with special devices, like smart cards or software, which can calculate the
correct response. The NAS will then forward the challenge and the response in the
Access-Request, which the AAA server will use to authenticate the user.
Microsoft Challenge Handshake Authentication Protocol (MS-CHAP)
An implementation of the CHAP protocol that Microsoft created to authenticate remote
Windows workstations. In most respects, MS-CHAP is identical to CHAP, but there are some
differences. MS-CHAP is based on the encryption and hashing algorithms used by Windows
networks, and the MS-CHAP response to a challenge is in a format optimized for
compatibility with Windows operating systems.
Extensible Authentication Protocol (EAP)
Like CHAP, EAP is a more secure authentication protocol to establish a PPP connection than
PAP and offers more flexibility to handle authentication requests with different encryption
algorithms. It allows authentication by encapsulating various types of authentication
exchanges, such as MD5. These EAP messages can be encapsulated in the packets of other
protocols, such as RADIUS, for compatibility with a wide range of authentication