Добавил:

Upload Опубликованный материал нарушает ваши авторские права? Сообщите нам.

Вуз:

Алматинский университет энергетики и связи

Предмет:

[НЕСОРТИРОВАННОЕ]

Файл:

20411B-ENU-TrainerHandbook

.pdf

Скачиваний:

237

Добавлен:

01.05.2015

Размер:

16.48 Mб

Скачать

☆

<<< < Предыдущая 17 18 19 20 21 22 23 24 25 26 27 2829 / 5329 30 31 32 33 34 35 36 37 38 39 40 41 > Следующая >>>

When EAP is chosen as the authentication method, the negotiation of the EAP type occurs between the access client and the NPS server.

Administering Windows Server® 2012	MCT
	8-13

You can configure NPS to accept multiple authentication methods. You also can configure your network access servers, also called RADIUS clients, to attempt to negotiate a connection with client computers by requesting the use of the most secure protocol first, then the next most secure, and so on, down to the least secure. For example, the Routing and Remote Access service tries to negotiate a connection by using the following protocols in the order shown:

1.	Extensible Authentication Protocol (EAP)	USE
2.	MS-CHAP v2	USE
2.	MS-CHAP v2
3.	MS-CHAP	.ONLY
4.	Challenge Handshake Authentication Protocol (CHAP)	.ONLY
4.	Challenge Handshake Authentication Protocol (CHAP)
5.	Shiva Password Authentication Protocol (SPAP)
6.	Password Authentication Protocol (PAP)

MS-CHAP Version 2

1.	The authenticator (the network access server or the NPS server) sends a challenge to the access client
	that consists of a session identifier and an arbitrary challenge string.	STUDENT
2.	The access client sends a response that contains:
	o The user name.
	o An arbitrary peer-challenge string.
	o A one-way encryption of the received challenge string, the peer-challenge string, the session
	identifier, and the user’s password.

3.	The authenticator checks the client’s response, and then sends back a response that contains:	USE
	o An indication of the connection attempt’s success or failure.
	o An authenticated response based on the sent challenge string, the peer-challenge string, the
	client’s encrypted response, and the user’s password.

4.	The access client verifies the authentication response and, if correct, uses the connection. If the
	authentication response is not correct, the access client terminates the connection.
1.	The authenticator (the network access server or the NPS server) sends a challenge to the access client
	that consists of a session identifier and an arbitrary challenge string.
2.	The access client sends a response that contains the user name and a nonreversible encryption of the
	challenge string, the session identifier, and the password.	PROHIBITED
3.	The authenticator checks the response and, if valid, authenticates the user’s credentials.

If you permit unauthenticated access, clients can connect without being authenticated if the authentication protocols that are configured on the access client do not match the authentication protocols that are configured on the network access server. In this case, the use of a common authentication protocol is not negotiated, and the access client does not send a user name and password. This circumstance creates a serious security problem. Therefore, unauthenticated access should not be allowed on most networks.

With unauthenticated access, user credentials (a user name and password) are not required. Although there are some situations in which unauthenticated access is useful, in most cases, we do not recommend that you deploy unauthenticated access to your organization’s network.

Unauthenticated Access

When you enable unauthenticated access, users can access your network without sending user credentials.USEPROHIBITED Additionally, unauthenticated access clients do not negotiate the use of a common authentication

protocol during the connection establishment process, and they do not send NPS a user name or password.

PAP uses plaintext passwords and is the least secure authentication protocol. It typically is negotiated if the access client and network access server cannot negotiate a more secure authentication method. When you enable PAP as an authentication protocol, user passwords are sent in plaintext form. Anyone

capturing the packets of the authentication process can read the password easily, and then use it to gain unauthorized access to your intranet. We highly discourage the use of PAP, especially for VPN connections.

PAP

8-14 Installing, Configuring, and Troubleshooting the Network Policy Server Role

Note: If you use MS-CHAP, MS-CHAP v2, or EAP-TLS as the authentication protocol, then you can use Microsoft Point-to-Point Encryption (MPPE) to encrypt the data that was sent on the Point-to-Point Protocol (PPP) or Point-to-Point Tunneling Protocol (PPTP) connection.

MS-CHAP v2 provides stronger security for network access connections than MS-CHAP. You should consider using MS-CHAP v2 instead of MS-CHAP.

CHAP

The CHAP is a challenge-response authentication protocol that uses the industry-standard Message Digest 5 (MD5) hashing scheme to encrypt the response.

Various vendors of network access servers and clients use CHAP. A server that is running Routing and Remote Access supports CHAP, so access clients that require CHAP are authenticated. Because CHAP requires the use of a reversibly-encrypted password, you should consider using another authentication protocol, such as MS-CHAP v2.

Additional Considerations

When implementing CHAP, consider the following:

•When users’ passwords expire, CHAP does not provide the ability for them to change passwords during the authentication process.

•Verify that your network access server supports CHAP before you enable it on an NPS server’s network policy. For more information, refer to your NAS documentation.

•You cannot use MPPE with CHAP.

STUDENT .ONLY USE MCT

Administering Windows Server® 2012 8-15

Using Certificates for Authentication		MCT
Certificates are digital documents that certification		MCT

		USE
authorities (CAs) issue, such as Active Directory
Certificate Services (AD CS) or the VeriSign public
CA. You can use certificates for many purposes,
such as code signing and securing email
communication. However, with NPS, you use

certificates for network access authentication
because they provide strong security for
authenticating users and computers, and
eliminate the need for less secure, password-
based authentication methods.

NPS servers use EAP-TLS and PEAP to perform		ONLY.
certificate-based authentication for many types of network access, including VPN and wireless
connections.

Authentication Methods

Two authentication methods, when you configure them with certificate-based authentication types, use certificates: EAP and PEAP. With EAP, you can configure the authentication type TLS (EAP-TLS), and with PEAP, you can configure the authentication types TLS (PEAP-TLS) and MS-CHAP v2 (PEAP-MS-CHAP v2). These authentication methods always use certificates for server authentication. Depending on the authentication type that you configure with the authentication method, you also might use certificates for user authentication and client computer authentication.

the server use certificates to verify their identities to each other, which is known as mutual authentication. Certificates must meet specific requirements to allow the server and the client to use them for mutual authentication.

	Note: Using certificates for VPN connection authentication is the strongest form of	STUDENT

authentication available in Windows Server 2008 R2. You must use certificates for IPsec
authentication on VPN connections that are based on Layer Two Tunneling protocol over
Internet protocol security (L2TP/IPsec). PPTP connections do not require certificates, although
		USE
you can configure PPTP connections to use certificates for computer authentication when you
use EAP-TLS as the authentication method. For wireless clients (computing devices with wireless
network adapters, such as your portable computer or personal digital assistant), use PEAP with
EAP-TLS and smart cards or certificates for authentication.

	Note: You can deploy certificates for use with NPS by installing and configuring the AD CS	PROHIBITED

server role.
Mutual Authentication
When you use EAP with a strong EAP type (such as TLS with smart cards or certificates), the client and
this object identifier must be present in the EKU extensions of the certificate or authentication will fail.

One such requirement is that the certificate is configured with one or more purposes in Extend Key Usage (EKU) extensions that correlate to the certificate use. For example, you must configure a certificate that you use for a client’s authentication with the Client Authentication purpose. Similarly, you must configure a certificate that you use for a server’s authentication with the Server Authentication purpose. When you use certificates for authentication, the authenticator examines the client certificate, seeking the correct purpose object identifier in EKU extensions. For example, the object identifier for the Client Authentication purpose is 1.3.6.1.5.5.7.3.2. When you use a certificate for client computer authentication,

8-16 Installing, Configuring, and Troubleshooting the Network Policy Server Role

Certificate Templates

Certificate Templates is an MMC snap-in that enables customization of certificates that AD CS issues. Customization possibilities include how certificates are issued and what the certificates contain, including their purposes. In Certificate Templates, you can use a default template, such as the Computer template, to define the template that the CA uses to assign certificates to computers. You also can create a certificate template and assign purposes to it in EKU extensions. By default, the Computer template includes the Client Authentication purpose and the Server Authentication purpose in EKU extensions.

The certificate template that you create can include any purpose for which you will use the certificate. For example, if you use smart cards for authentication, you can include the Smart Card Logon purpose as well as the Client Authentication purpose. When using NPS, you can configure NPS to check certificate purposes before granting network authorization. NPS can check additional EKUs and Issuance Policy purposes, also known as Certificate Policies.

Note: Some non-Microsoft CA software might contain a purpose named All, which represents all possible purposes. This is indicated by a blank (or null) EKU extension. Although All is intended to mean all possible purposes, you cannot substitute the All-purpose for the Client Authentication purpose, the Server Authentication purpose, or any other purpose that is related to network access authentication.

Required Certificates for Authentication

The following table details the certificates that are required to deploy each of the listed certificatebased authentication methods successfully.

Certificate	Required for EAP-TLS and	Required for PEAP-MS-	Details
	Required for EAP-TLS and	Required for PEAP-MS-
	PEAP-TLS?	CHAP v2?
	PEAP-TLS?	CHAP v2?

CA certificate in	Yes. The CA certificate is	Yes. This certificate is	For PEAP-MS-CHAP
the Trusted Root	enrolled automatically for	enrolled automatically	v2, this certificate is
Certification	domain member	for domain member	required for mutual
Authorities	computers. For nondomain	computers. For	authentication
certificate store for	member computers, you	nondomain member	between client and
the Local	must import the certificate	computers, you must	server.
Computer and	manually into the certificate	import the certificate
Current User	store.	manually into the
		certificate store.

PROHIBITED USE STUDENT .ONLY USE MCT

using its certificate. Client computer and user authentication is accomplished by using certificates from the client certificate store or a smart card, providing mutual authentication.

With wireless clients, you can use PEAP-MS-CHAP v2 as the authentication method. PEAP-MS-CHAP v2 a password-based user authentication method that uses TLS with server certificates. During PEAP-MS- CHAP v2 authentication, the NPS server supplies a certificate to validate its identity to the client (if the Validate server certificate option is configured on the Windows 8 client). Client computer and user authentication is accomplished with passwords, which eliminates some of the difficulty of deploying certificates to wireless client computers.

If you configure the

in a variety of ways.

Administering Windows Server® 2012

MCT

8-17

Certificate

Required for EAP-TLS and

Required for PEAP-MS-

Details

PEAP-TLS?

CHAP v2?

Client computer

Yes. Client computer

No. User

If you deploy user

USE

certificate in the

certificates are required

authentication is

certificates on smart

certificate store of

unless user certificates are

performed with

cards, client

the client

distributed on smart cards.

password-based

computers do not

Client certificates are

credentials, not

need client

enrolled automatically for

certificates.

domain member

.ONLY

of the NPS server

computers. For nondomain

certificates, you can

to the client

member computers, you

must import the certificate

manually or obtain it with

the Web-enrollment tool.

Server certificate in

Yes. You can configure

Yes. In addition to

The NPS server sends

the certificate store

AD CS to autoenroll server

using AD CS for server

the server certificate

certificates to members of

purchase server

computer. The client

the RAS and IAS servers

certificates from other

computer uses the

STUDENT

group in AD DS.

CAs that client

certificate to

computers already

authenticate the NPS

trust.

server.

User certificate on

AD CS to auto-enroll server

No. User

For EAP-TLS and

a smart card

certificates to members of

authentication is

PEAP-TLS, if you do

the RAS and IAS servers

performed with

not auto-enroll client

group in AD DS.

password-based

computer certificates,

credentials, not

user certificates on

certificates.

smart cards are

required.

The Institute of Electrical and Electronics Engineers, Inc. (IEEE) 802.1X authentication provides authenticated access to 802.11 wireless networks and wired Ethernet networks. 802.1X provides support

for secure EAP types, such as TLS with smart cards or certificates. You can configure 802.1X with EAP-TLSUSE

Validate server certificate option on the client, the client authenticates the server by

PROHIBITEDis

8-18 Installing, Configuring, and Troubleshooting the Network Policy Server Role

Deploying Certificates for PEAP and EAP

All certificates that you use for network access authentication with EAP-TLS and PEAP must meet the requirements for X.509 certificates and work for connections that use Secure Sockets LayerTransport Layer Security (SSL/TLS). After this minimum requirement is met, both client and server certificates have additional requirements.

Minimum Server Certificate Requirements

You can configure clients to validate server certificates by using the Validate server certificate option within the authentication protocol’s

properties. With PEAP-MS-CHAP v2, PEAP-TLS, or EAP-TLS as the authentication method, the client accepts the server authentication attempt when the certificate meets the following requirements:

.ONLY USE MCT

•The Subject name contains a value. If you issue a certificate to your NPS server that has a blank STUDENT Subject, the certificate is not available to authenticate your NPS server. To configure the certificate

template with a Subject name:

a.Open Certificate Templates.

b.In the details pane, right-click the certificate template that you want to change, and then click

Properties.

c.Click the Subject Name tab, and then click Build from this Active Directory information.

d.In Subject name format, select a value other than None.

•The computer certificate on the server chains to a trusted root CA, and does not fail any of the checks that CryptoAPI performs and that the remote access or network policies specify.

•The NPS or VPN server computer certificate is configured with the Server Authentication purpose in

EKU extensions (the object identifier for Server Authentication is 1.3.6.1.5.5.7.3.1). USE

•The server certificate is configured with a required algorithm value of RSA. To configure the required cryptography setting:

a.Open Certificate Templates.

b.In the details pane, right-click the certificate template that you want to change, and then click PROHIBITED

Properties.

c.Click the Cryptography tab. In Algorithm name, click RSA. Ensure that Minimum key size is set to 2048.

•The Subject Alternative Name (SubjectAltName) extension, if you use it, must contain the server’s fully qualified domain name (FQDN). To configure the certificate template with the Domain Name System (DNS) name of the enrolling server:

a.Open Certificate Templates.

b.In the details pane, right-click the certificate template that you want to change, and then click

Properties.

c.Click the Subject Name tab, and then click Build from this Active Directory information.

d.In Include this information in alternate subject name, select DNS name.

Administering Windows Server® 2012		MCT
Administering Windows Server® 2012	8-19
With PEAP and EAP-TLS, NPS servers display a list of all installed certificates in the computer certificate
store, except the following:
• Certificates that do not contain the Server Authentication purpose in EKU extensions.		USE
• Certificates that do not contain a subject name.
• Registry-based and smart card-logon certificates.
Minimum Client Certificate Requirements

With EAP-TLS or PEAP-TLS, the server accepts the client authentication attempt when the certificate meets

• An enterprise CA issued the client certificate or it is mapped to an Active Directory user or computer account.

• The user or computer certificate on the client chains to a trusted-root CA; the certificate includes

the Client Authentication purpose in EKU extensions (the object identifier for Client Authentication
is 1.3.6.1.5.5.7.3.2); and fails neither the checks that CryptoAPI performs, which the remote access orONLY
network policies specify, nor the Certificate object identifier checks that the NPS network policies		.
		STUDENT
specify.
• The 802.1X client does not use registry-based certificates that are either smart card-logon or
password-protected certificates.
• For user certificates, the Subject Alternative Name (SubjectAltName) extension in the certificate
contains the user principal name (UPN). To configure the UPN in a certificate template:
a. Open Certificate Templates.
b. In the details pane, right-click the certificate template that you want to change, and then click
	Properties.
c.	Click the Subject Name tab, and then click Build from this Active Directory information.
d. In Include this information in alternate subject name, select User principal name (UPN).

• For computer certificates, the Subject Alternative Name (SubjectAltName) extension in the certificate
must contain the client’s FQDN, also known as the DNS name. To configure this name in the		USE
certificate template:
a.	Open Certificate Templates.

b. In the details pane, right-click the certificate template that you want to change, and then click		PROHIBITED
	Properties.
c. Click the Subject Name tab, and then click Build from this Active Directory information.
d. In Include this information in alternate subject name, select DNS name.
With
the
• Wireless clients do not display registry-based and smart card-logon certificates.
• Wireless clients and VPN clients do not display password-protected certificates.
• Certificates that do not contain the Client Authentication purpose in EKU extensions.

8-20 Installing, Configuring, and Troubleshooting the Network Policy Server Role	MCT


Lesson 4
Monitoring and Troubleshooting a Network Policy Server	USE
You can monitor NPS by configuring and using logging for events, and user authentication and	USE

accounting requests. Event logging enables you to record NPS events in the system and security event
logs. You can use request logging for connection analysis and billing purposes. The information that the
log files collect is useful for troubleshooting connection attempts and for security investigation.
Lesson Objectives	.ONLY
After completing this lesson, you will be able to:
• Describe the methods for monitoring NPS.
• Describe how to configure log file properties.
• Describe how to configure SQL Server logging in NPS.
• Describe how to configure NPS events to be recorded in Event Viewer.
Methods Used to Monitor NPS		STUDENT
The two types of accounting, or logging, that you
The two types of accounting, or logging, that you
can use to monitor NPS are:
• Event logging for NPS. You can use event
logging to record NPS events in the system
and security event logs. You use this primarily
for auditing and troubleshooting connection
attempts.
• Logging user authentication and accounting
requests. You can log user authentication and		USE
accounting requests to log files in text format		USE
accounting requests to log files in text format
or database format, or you can log to a stored
or database format, or you can log to a stored
procedure in a SQL Server database. Use
request logging primarily for connection analysis and billing purposes, and as a security investigation
tool, because it enables you to identify an attacker’s activity.

•Turn on logging (initially) for authentication and accounting records. Modify these selections after PROHIBITED you determine what is appropriate for your environment.

•Ensure that you configure event logging with sufficient capacity to maintain your logs.

•Back up all log files on a regular basis, because they cannot be recreated when damaged or deleted.

•Use the RADIUS Class attribute to track usage and simplify identification of which department or user to charge for usage. Although the Class attribute, which is generated automatically, is unique for each request, duplicate records might exist in cases where the reply to the access server is lost and the request is re-sent. You might need to delete duplicate requests from your logs to track usage accurately.

•To provide failover and redundancy with SQL Server logging, place two computers that are running SQL Server on different subnets. Use the SQL Server Create Publication Wizard to set up database replication between the two servers. For more information, refer to the SQL Server documentation.

		Administering Windows Server® 2012	MCT
		Administering Windows Server® 2012	8-21
	Note: To interpret logged data, view the information on the Microsoft TechNet website:

Interpret NPS Database Format Log Files
http://go.microsoft.com/fwlink/?LinkID=214832&clcid=0x409			USE
Logging NPS Accounting
You can configure NPS to perform RADIUS

			.ONLY
accounting for user authentication requests,
Access-Accept messages, Access-Reject messages,
Access-Accept messages, Access-Reject messages,
accounting requests and responses, and periodic
status updates. You can use this procedure to
configure the log files where you want to store
the accounting data.
Considerations for Configuring
Accounting for NPS

•To send the log file data for collection by another process, you can configure NPS to write to a STUDENT named pipe. To use named pipes, set the log file folder to \\.\pipe or \\ComputerName\pipe. The

named pipe server program creates a named pipe called \\.\pipe\iaslog.log to accept the data. In the

Local File Properties dialog box, in Create a new log file, select Never (unlimited file size) when you use named pipes.

•To create the log file directory, use system environment variables (instead of user variables),

such as %systemdrive%, %systemroot%, and %windir%. For example, the following path, using the environment variable %windir%, locates the log file at the system directory in the subfolder \System32\Logs (that is, %windir%\System32\Logs\).

•Switching log-file formats does not cause a new log to be created. If you change log file formats,

the file that is active when the change occurs will contain a mixture of the two formats. Records at theUSE log’s start will have the previous format, and records at the log’s end will have the new format.

•If you are administering an NPS server remotely, you cannot browse the directory structure. If you need to log accounting information to a remote server, specify the log file name by typing a Universal Naming Convention (UNC) name, such as \\MyLogServer\LogShare.

•If RADIUS accounting fails due to a full hard-disk drive or other causes, NPS stops processing PROHIBITED connection requests, which prevents users from accessing network resources.

•NPS enables you to log to a SQL Server database in addition to, or instead of, logging to a local file.3.2.

8-22 Installing, Configuring, and Troubleshooting the Network Policy Server Role

4.In Log File Properties, on the Log File tab, in Directory, type the location where you want to store NPS log files. The default location is the systemroot\System32\LogFiles folder.

5.In Format, select from DTS Compliant, ODBC (Legacy), and IAS (Legacy).

6.To configure NPS to start new log files at specified intervals, click the interval that you want to use: o For heavy transaction volume and logging activity, click Daily.

o For lesser transaction volumes and logging activity, click Weekly or Monthly. o To store all transactions in one log file, click Never (unlimited file size).

o To limit the size of each log file, click When log file reaches this size, and then type a file size, after which a new log is created. The default size is 10 megabytes (MB).

7.To configure NPS to delete log files automatically when the disk is full, click When disk is full delete older log files. If the oldest log file is the current log file, it is not deleted.

Note: To complete this procedure, you must be a member of the Domain Admins group, the Enterprise Admins group, or the Administrators group on the local computer.

Configuring SQL Server Logging

You can configure NPS to perform RADIUS accounting to a SQL Server database. You can use this procedure to configure logging properties and the connection to the running SQL Server that stores your accounting data. The SQL Server database can be on the local computer or on a remote server.

Note: NPS formats accounting data as an XML document that it sends to the report_event stored procedure in the SQL Server database that you designate in NPS. For SQL Server logging to

function properly, you must have a stored procedure named report_event in the SQL Server database that can receive and parse the XML documents from NPS.

Configuring SQL Server Logging in NPS

To configure SQL Server logging in NPS using the Windows interface, perform the following tasks:

1.Open the Network Policy Server MMC snap-in.

2.In the console tree, click Accounting.

3.In the details pane, click Change SQL Server Logging Properties. The SQL Server Logging Properties dialog box opens.

4.In Log the following information, select the information that you want to log: o To log all accounting requests, select Accounting requests.

o To log authentication requests, select Authentication requests.

o To log periodic status, such as interim accounting requests, select Periodic accounting status.

PROHIBITED USE STUDENT .ONLY USE MCT

<<< < Предыдущая 17 18 19 20 21 22 23 24 25 26 27 2829 / 5329 30 31 32 33 34 35 36 37 38 39 40 41 > Следующая >>>

Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]

#
01.05.201559.39 Кб101_Diplom_Trebovania_Tekhnika_bezopasnosti.doc
#
01.05.201548.15 Кб272 д-ріс.docx
#
01.05.2015110.08 Кб152 лаба.doc
#
01.05.2015224.26 Кб52-РГР техника жне технология негіздері.doc
#
01.05.2015624.64 Кб542012215.pdf
#
01.05.201516.48 Mб23720411B-ENU-TrainerHandbook.pdf
#
01.05.2015134.66 Кб182192_srs2_politology.doc
#
10.03.2016475.65 Кб52222.doc
#
01.05.201569.93 Кб1924 билет ЗИ в ТКС.docx
#
01.05.201518.89 Кб133 д-ріс.docx
#
01.05.2015675.84 Кб123 лаба метод указ.doc