Cyberstudy
PDF p.101 In progress

Local, Network, and Remote Authentication

Open PDF at p.101 22 flashcards

Summary

PDF p.101

Authentication providers in operating systems ensure users are authenticated before accessing the system. Knowledge-based authentication uses cryptographic hashes to secure passwords. Windows and Linux have distinct methods for local, network, and remote authentication.

In plain words

Supplementary — not from your PDF

Windows checks local sign-ins against the SAM database and domain sign-ins through Active Directory (usually Kerberos, sometimes old NTLM). Linux keeps accounts in /etc/passwd and password hashes in /etc/shadow, and uses SSH keys for remote logins. Passwords are stored as hashes.

Detailed explanation

PDF p.101
  • Knowledge-Based Authentication
    • Cryptographic Hashes: Passwords are stored as hashes to prevent compromise.
    • Process: User-entered passwords are hashed and compared to stored hashes for authentication.
  • Windows Authentication
    • Local Sign-In
      • Component: Local Security Authority Subsystem Service (LSASS).
      • Process: Compares credentials to hashes in the Security Accounts Manager (SAM) database.
      • Term: Also known as interactive logon.
    • Network Sign-In
      • Component: LSASS passes credentials to an Active Directory (AD) domain controller.
      • Preferred System: Kerberos for network authentication.
      • Legacy System: NT LAN Manager (NTLM) for older applications.
    • Remote Sign-In
      • Usage: For devices not directly connected to the local network.
      • Methods: Virtual private network (VPN), enterprise Wi-Fi, web portal.
      • Protocols: Secure connection between client, remote access device, and authentication server.
  • Linux Authentication
    • Local Authentication
      • Storage: User account names in /etc/passwd.
      • Password Check: Against hashes in /etc/shadow.
    • Network Authentication
      • Method: Secure Shell (SSH).
      • Authentication: Using cryptographic keys instead of passwords.
    • Pluggable Authentication Module (PAM)
      • Purpose: Enables different authentication providers (e.g., smart-card log-in).
      • Usage: Implements authentication to network directory services.

Important terms

taken from the text above
Cryptographic Hashes
Passwords are stored as hashes to prevent compromise.
Term
Also known as interactive logon.
Preferred System
Kerberos for network authentication.
Legacy System
NT LAN Manager (NTLM) for older applications.
Protocols
Secure connection between client, remote access device, and authentication server.
Storage
User account names in /etc/passwd.
Password Check
Against hashes in /etc/shadow.
Authentication
Using cryptographic keys instead of passwords.
LSASS Local Security Authority Subsystem Service SAM Security Accounts Manager AD Active Directory NTLM NT LAN Manager VPN Virtual private network SSH Secure Shell PAM Pluggable Authentication Module

Examples & real-world scenarios

Supplementary — not from your PDF
  • Windows interactive logon checked by LSASS against the SAM.
  • Domain logon using Kerberos to a domain controller.
  • Linux PAM modules enabling smart-card logins.

Scenario

A legacy app still uses NTLM for network logins. The security team plans to move it to Kerberos, the preferred and more secure protocol.

Common mistakes

Supplementary — not from your PDF
  • Thinking /etc/passwd holds the password hashes. They're in /etc/shadow.
  • Confusing Linux PAM (Pluggable Authentication Modules) with privileged access management, which is also called PAM.

Practical skills

Supplementary — not from your PDF
  • Say where credentials are checked for local, domain and remote logins.

What I should remember

Key Points PDF p.101
  • Knowledge-Based Authentication
    • Hashes: Secure password storage.
    • Comparison: User-entered password hashes vs. stored hashes.
  • Windows Authentication
    • Local Sign-In: LSASS and SAM database.
    • Network Sign-In: LSASS, AD domain controller, Kerberos, NTLM.
    • Remote Sign-In: VPN, enterprise Wi-Fi, web portal.
  • Linux Authentication
    • Local: /etc/passwd and /etc/shadow.
    • Network: SSH and cryptographic keys.
    • PAM: Supports various authentication providers.