WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Remote Network Security

You can configure your dial-up, virtual private network (VPN), and direct connections to enforce various levels of password authentication and data encryption. Authentication methods range from unencrypted to custom, such as the Extensible Authentication Protocol (EAP). EAP provides flexible support for a wide range of authentication methods, including smart cards, certificates, one-time passwords, and public keys. You can also specify the type of data encryption, depending on the type of authentication protocol (MS-CHAP or EAP-TLS) that you choose. Finally, if allowed by your system administrator, you can configure callback options to save telephone charges, and to increase dial-up security.

On the server to which you are connecting, remote access permissions on a Windows 2000 remote access server are granted based on the dial-in settings of your user account and remote access policies. Remote access policies are a set of conditions and connection settings that give network administrators more flexibility in granting remote access permissions and usage. If the settings of your connection do not match at least one of the remote access policies that apply to your connection, the connection attempt is rejected, regardless of your dial-in settings.

The network administrator can configure Windows 2000 user accounts and domains to provide security by forcing encrypted authentication and encrypted data for remote communications. For more information about Windows 2000 security, see Windows 2000 Server Help.

How Security Works at Connection

The following steps describe what happens during a call to a remote access server:

Your computer dials a remote access server.

Depending on the authentication methods you have chosen, one of the following happens:

If You Are Using PAP or SPAP

Your computer sends its password to the server.

The server checks the account credentials against the user database.

If You Are Using CHAP or MS-CHAP

The server sends a challenge to your computer.

Your computer sends an encrypted response to the server.

The server checks the response against the user database.

If You Are Using MS-CHAP v2

The server sends a challenge to your computer.

Your computer sends an encrypted response to the server.

The server checks the response against the user database, and sends back an authentication response.

Your computer verifies the authentication response.

If You Are Using Certificate-based Authentication

The server requests credentials from your computer, and sends its own certificate.

If you configured your connection to Validate server certificate, it is validated. If not, this step is skipped.

Your computer presents its certificate to the server.

The server verifies that the certificate is valid, and that it has not been revoked.

If the account is valid, the server checks for remote access permission.

If remote access permissions have been granted, the server accepts your connection. For a Windows 2000 server, permission is granted based on the remote access permission of the user account and the remote access policies.

If callback is enabled, the server calls your computer back and repeats steps 2 through 4.

NOTE

---

If you are using an L2TP-enabled VPN, IP Security (IPSec) authenticates your computer account and provides encryption before any of these steps take place. For more information about IPSec, see "Data Encryption" later in this chapter.

Authentication

For dial-up, virtual private network (VPN), and direct connections, Windows 2000 authentication is implemented in two processes: interactive logon and network authorization. Successful user authentication depends on both of these processes.

Interactive Logon Process

The interactive logon process confirms the user's identity to either a domain account or a local computer. Depending on the type of user account and whether the computer is connected to a network protected by a domain controller, the process can vary as follows:

A domain account

A user logs on to the network with a password or smart card, using credentials that match those stored in Active Directory. By logging on with a domain account, an authorized user can access resources in the domain and any trusting domains. If a password is used to log on to a domain account, Windows 2000 uses Kerberos v5 for authentication. If a smart card is used instead, Windows 2000 uses Kerberos v5 authentication with certificates.

A local computer account

A user logs on to a local computer, using credentials stored in Security Account Manager (SAM), which is the local security account database. Any workstation can maintain local user accounts, but those accounts can only be used for access to that local computer.

Network authorization confirms the user's identification to any network service or resource that the user is attempting to access. To provide this type of authorization, the Windows 2000 security system supports many different mechanisms, including Kerberos v5, Secure Socket Layer/Transport Layer Security (SSL/TLS), and, for compatibility with Windows NT 4.0 and Windows NTLM.

Users who have logged onto a domain account do not see network authorization challenges during their logon session. Users who have logged onto a local computer account must provide credentials (such as a user name and password) every time they access a network resource.

Logging On Using Domain Credentials

The credentials that you use to initially log on to your computer are also the credentials that are presented to a domain when attempting to access a network resource. Therefore, if your local logon and network authorization credentials differ, you are prompted to provide Windows 2000 domain credentials each time you access a network resource. You can avoid this by logging on to your computer by using your Windows 2000 domain name, your Windows 2000 domain user name, and your Windows 2000 domain password before you try to connect to a network resource. If you log on without being connected to the network, Windows 2000 recognizes that your credentials match a previous successful logon, and you receive the following message: "Windows cannot connect to a server to confirm your logon settings. You have been logged on using previously stored account information." When you connect to your network, the cached credentials are sent to your Windows 2000 domain and you are able to access network resources without having to provide a password again.

Authentication Protocols

With Network and Dial-up Connections, you can use the following authentication methods and protocols.

PAP

Password Authentication Protocol (PAP) uses plaintext (unencrypted) passwords and is the least sophisticated authentication protocol. PAP is typically used when your connection and the server cannot negotiate a more secure form of validation. You might need to use this protocol when you are calling a non-Windows-based server.

SPAP

With Shiva Password Authentication Protocol (SPAP), Shiva clients can dial in to computers running Windows 2000 Server, and Windows 2000 clients can dial into Shiva servers.

CHAP

The Challenge Handshake Authentication Protocol (CHAP) negotiates a secure form of encrypted authentication, by using Message Digest 5 (MD5), an industry-standard hashing scheme. A hashing scheme is a method for transforming data (for example, a password) in such a way that the result is unique and cannot be changed back to its original form. CHAP uses challenge-response with one-way MD5 hashing on the response. In this way, you can prove to the server that you know your password without actually sending the password over the network. By supporting CHAP and MD5, Network and Dial-up Connections is able to securely connect to almost all third-party PPP servers.

NOTE

---

If your server requires you to use PAP, SPAP, or CHAP, you cannot require data encryption for dial-up or PPTP connections.

If the connection is configured to require encrypted authentication, and connects to a server that is only configured for cleartext authentication, the connection hangs up.

MS-CHAP

Microsoft created Microsoft Challenge Handshake Authentication Protocol (MS-CHAP), an extension of CHAP, to authenticate remote Windows workstations, providing the functionality to which LAN-based users are accustomed while integrating the encryption and hashing algorithms used on Windows networks. Like CHAP, MS-CHAP uses a challenge-response mechanism with one-way encryption on the response.

Where possible, MS-CHAP is consistent with standard CHAP. Its response packet is in a format specifically designed for networking with computers running Microsoft® Windows NT and Windows 2000, and Microsoft® Windows 95 and Microsoft® Windows 98.

Your system administrator can define authentication retry and password changing rules for the users connecting to your server.

A version of MS-CHAP is available specifically for connecting to a Windows 95 server. This is required only if your connection is being made to a Windows 95 server.

MS-CHAP v2

A new version of the Microsoft Challenge Handshake Authentication Protocol (MS-CHAP v2) is available. This new protocol provides mutual authentication, stronger initial data encryption keys, and different encryption keys for sending and receiving. To minimize the risk of password compromise during MS-CHAP exchanges, MS-CHAP v2 supports only a newer, more secure, version of the MS-CHAP password change.

For VPN connections, Windows 2000 Server offers MS-CHAP v2 before offering MS-CHAP. Updated Windows clients accept MS-CHAP v2 when it is offered. Dial-up connections are not affected.

In Windows 2000, both dial-up and VPN connections can use MS-CHAP v2. Windows NT 4.0 and Windows 98-based computers can use only MS-CHAP v2 authentication for VPN connections.

EAP

The Extensible Authentication Protocol (EAP) is an extension to the Point-to-Point Protocol (PPP). EAP was developed in response to an increasing demand for remote access user authentication that uses third-party security devices. EAP provides a standard mechanism for support of additional authentication methods within PPP. By using EAP, support for a number of authentication schemes might be added, including token cards, one-time passwords, public key authentication using smart cards, certificates, and others. EAP is a critical technology component for secure virtual private network (VPN) connections, because it can offer stronger authentication methods (such as public key certificates) that are more secure against brute-force attacks, dictionary attacks, and password guessing than older password-based authentication methods.

To find out if you can use EAP, see your system administrator.

Smart Card and Other Certificate Authentication

If a user certificate is installed either in the certificate store on your computer or on a smart card, and the Extensible Authentication Protocol Transport Level Security (EAP-TLS) is enabled, you can use certificate-based authentication in a single network logon process, which provides tamper-resistant storage of authentication information.

A certificate is an encrypted set of authentication credentials. A certificate includes a digital "signature" from the certificate authority that issued the certificate. In the certificate authentication process, your computer presents its certificate to the server, and the server presents its certificate to your computer, enabling mutual authentication. Certificates are authenticated by verifying the digital signature by means of a public key, which is contained in a trusted authority root certificate that is already stored on your computer. These root certificates are the basis for certificate verification, and are supplied only by a system administrator. Windows 2000 provides a number of trusted root certificates. Add or remove trusted root certificates only if your system administrator advises.

Certificates can reside either in the certificate store on your computer or on a smart card. A smart card is a credit card-sized device that is inserted into a smart card reader, which is either installed internally in your computer or connected externally to your computer.

By setting the security options of a connection, you can choose to use a smart card or other certificate, and you can specify particular certificate requirements. For example, you can specify that the server's certificate must be validated, and you can also specify the server's certificate root authority, which is trusted.

When you double-click Make New Connection in the Network and Dial-up Connections folder, if a smart card reader is installed, Windows 2000 detects it and prompts you to use it as the authentication method for the connection. If you decide not to use the smart card at the time you create a connection, you can modify the connection to use the smart card or other certificate at a later time.

Data Encryption

You can think of encryption as locking something valuable into a strong box with a key. Sensitive data is encrypted by using a key algorithm, which renders it unreadable without the knowledge of the key. Data encryption keys are determined at connect time between a connection and the computer on the other end. The use of data encryption can be initiated by your computer or by the server to which you are connecting.

For dial-up, virtual private network (VPN) and direct connections, Network and Dial-up Connections supports two types of encryption: Microsoft Point-to-Point Encryption (MPPE), which uses Rivest-Shamir-Adlemen (RSA) RC4 encryption, and an implementation of Internet Protocol security (IPSec) that uses Data Encryption Standard (DES) encryption. Both MPPE and IPSec support multiple levels of encryption.

Server controls are flexible and can be set to deny the use of encryption, require a specific encryption method, or allow your computer to select an encryption method. By default, most servers allow encryption and allow clients to select their encryption methods. This works for most computers. For a Windows 2000-based remote access or VPN server, the system administrator sets encryption requirements through settings on remote access policies. To determine your encryption settings, contact your system administrator.

To enable MPPE-based data encryption for dial-up or VPN connections, you must select the MS-CHAP, MS-CHAP v2, or Extensible Authentication Protocol-Transport Level Security (EAP-TLS) authentication methods. These authentication methods generate the keys used in the encryption process.

Virtual private networks (VPNs) use encryption depending on the type of server to which they are connecting. If the VPN connection is configured to connect to a PPTP server, MPPE is used. If the VPN is configured to connect to an L2TP server, IPSec encryption methods are used. If the VPN is configured for an automatic server type (which is the default selection), then L2TP is attempted first, followed by PPTP.

MPPE

Microsoft Point-to-Point Encryption (MPPE) encrypts data in PPP-based dial-up connections or PPTP VPN connections. Strong (128-bit key) and standard (56-bit key or 40-bit key) MPPE encryption schemes are supported. MPPE provides data security between your computer and your dial-up server (for dial-up PPP connections) and between your computer and your PPTP-based VPN server (for VPN connection).

NOTE

---

MPPE requires common client and server keys as generated by MS-CHAP, MS-CHAP v2, or EAP-TLS authentication.

IPSec

IP security (IPSec) is a suite of cryptography-based protection services and security protocols. Because it requires no changes to applications or protocols, you can easily deploy IPSec for existing networks.

IPSec provides machine-level authentication, as well as data encryption, for L2TP-based VPN connections. IPSec negotiates a secure connection between your computer and its remote tunnel server before an L2TP connection is established, which secures user names, passwords, and data.

IPSec encryption does not rely on the authentication method to provide initial encryption keys. Therefore, L2TP connections use all standard PPP-based authentication protocols, such as EAP-TLS, MS-CHAP, CHAP, SPAP, and PAP, to authenticate the user after the secure IPSec communication is established.

Encryption is determined by the IPSec Security Association, or SA. A security association is a combination of a destination address, a security protocol, and a unique identification value, called a Security Parameters Index (SPI). The available encryptions include:

Data Encryption Standard (DES) with a 56-bit key.

Triple DES (3DES), which uses three 56-bit keys and is designed for high-security environments.

NOTE

---

The IP security settings that are associated with TCP/IP properties apply to all connections for which TCP/IP is enabled.

Callback

The callback feature provides cost advantages to you. Callback instructs your dial-in server to disconnect, and then to call you back after you dial in. By immediately hanging up and then calling you back, your phone charges are reduced.

If the feature is required by your system administrator, it also provides security advantages to your network. Requiring callback to a particular number enhances network security by ensuring that only users from specific locations can gain access to the server. Dropping the call and then immediately calling back to the preassigned callback number makes impersonation more difficult.

For more information about callback, see "Configuring Advanced Settings" earlier in this chapter.