Figure 2: Possibly Risky Topology: Multiple Hosts Sharing a PPP Connection to a Network Access Server This figure shows multiple hosts sharing a PPP connection to a network access server. Accessing the User Profile After Double Authentication In double authentication, when a remote user establishes a PPP link to the local host using the local host name, the remote host is CHAP (or PAP) authenticated. After CHAP (or PAP) authentication, PPP negotiates with AAA to assign network access privileges associated with the remote host to the user.
(We suggest that privileges at this stage be restricted to allow the user to connect to the local host only by establishing a Telnet connection.) When the user needs to initiate the second phase of double authentication, establishing a Telnet connection to the local host, the user enters a personal username and password (different from the CHAP or PAP username and password). This action causes AAA reauthentication to occur according to the personal username/password. The initial rights associated with the local host, though, are still in place.
By using the access-profile command, the rights associated with the local host are replaced by or merged with those defined for the user in the user’s profile. To access the user profile after double authentication, use the following command in EXEC configuration mode: Device> access-profile merge ignore-sanity-checks If you configured the access-profile command to be executed as an autocommand, it will be executed automatically after the remote user logs in. CHAP or PAP Authentication One of the most common transport protocols used in ISPs dial solutions is the Point-to-Point Protocol (PPP). Traditionally, remote users dial in to an access server to initiate a PPP session.
After PPP has been negotiated, remote users are connected to the ISP network and to the Internet. Because ISPs want only customers to connect to their access servers, remote users are required to authenticate to the access server before they can start up a PPP session. Normally, a remote user authenticates by typing in a username and password when prompted by the access server. Although this is a workable solution, it is difficult to administer and awkward for the remote user. A better solution is to use the authentication protocols built into PPP. In this case, the remote user dials in to the access server and starts up a minimal subset of PPP with the access server.
This does not give the remote user access to the ISP’s network--it merely allows the access server to talk to the remote device. PPP currently supports two authentication protocols: Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP). Both are specified in RFC 1334 and are supported on synchronous and asynchronous interfaces. Authentication via PAP or CHAP is equivalent to typing in a username and password when prompted by the server. CHAP is considered to be more secure because the remote user’s password is never sent across the connection.
Configuring Authentication Accessing the User Profile After Double Authentication Configuring Authentication 12