AAA (Authentication, Authorization and Accounting)

Ağ güvenliği tanımlamasında authentication, authorization and accounting terimlerinin baş harflerinin simgelediği, network üzerinden gelen bilgi paketlerini bazi modellere göre dikkatlice inceleyerek kötü niyetli aktiviteleri haber veren bir sistemdir.

Authentication : server, switch ya da router kullanimlarinda cihaz ya da kullanicinin kimliginin onaylanmasidir.

Authorization : kullanici ya da kullanicilara sisteme, programa ve network erisim hakkinin verilmesidir.

Accounting : herhangi bir kullanicinin ne yaptigi, kullanici hareketleri kullanici data baglantilari ve kullanici sistem kayitlarinin izlenebilmesi amaciyla yapilan islemdir.

1. Cihaz isimleri ve ip address verme.

[Huawei]sysname CLIGURU-R1

[CLIGURU-R1]interface GigabitEthernet 0/0/0

[CLIGURU-R1-GigabitEthernet0/0/0]ip address 119.84.111.1 24

[Huawei]sysname CLIGURU-R3

[CLIGURU-R3]interface GigabitEthernet 0/0/0

[CLIGURU-R3-GigabitEthernet0/0/0]ip address 119.84.111.3 24

CLIGURU-R1 ve CLIGURU-R3 arasındaki bağlantıyı kontrol edelim.

<CLIGURU-R1>ping 119.84.111.3

PING 119.84.111.3: 56 data bytes, press CTRL_C to break

Reply from 119.84.111.3: bytes=56 Sequence=1 ttl=255 time=140 ms

Reply from 119.84.111.3: bytes=56 Sequence=2 ttl=255 time=60 ms

Reply from 119.84.111.3: bytes=56 Sequence=3 ttl=255 time=60 ms

Reply from 119.84.111.3: bytes=56 Sequence=4 ttl=255 time=60 ms

Reply from 119.84.111.3: bytes=56 Sequence=5 ttl=255 time=60 ms

— 119.84.111.3 ping statistics —

5 packet(s) transmitted

5 packet(s) received

0.00% packet loss

round-trip min/avg/max = 60/76/140 ms

2. CLIGURU-R1 cihazı için AAA konfigürasyonunu yapılandıralım.

CLIGURU-R1 routeri için authentication-schame ve authorization-schame konfigurasyonlarını tamamlayalım ve aynı ayarları CLIGURU-R3 içinde yapalım.

[CLIGURU-R1]aaa

[CLIGURU-R1-aaa]authentication-scheme auth1

Info: Create a new authentication scheme.

[CLIGURU-R1-aaa-authen-auth1]authentication-mode local

[CLIGURU-R1-aaa-authen-auth1]quit

[CLIGURU-R1-aaa]authorization-scheme auth2

Info: Create a new authorization scheme.

[CLIGURU-R1-aaa-author-auth2]authorization-mode local

[CLIGURU-R1-aaa-author-auth2]quit

CLIGURU-R1’in domaini huawei olarak yapılandıralım, daha sonra oluşturduğumuz kullanıcılarda buna uygun olarak yapılandıralım.

[CLIGURU-R1-aaa]domain huawei

Info: Success to create a new domain.

[CLIGURU-R1-aaa-domain-huawei]authentication-scheme auth1

[CLIGURU-R1-aaa-domain-huawei]authorization-scheme auth2

[CLIGURU-R1-aaa-domain-huawei]quit

[CLIGURU-R1-aaa]local-user user1@huawei password cipher huawei

Info: Add a new user.

[CLIGURU-R1-aaa]local-user user1@huawei service-type telnet

[CLIGURU-R1-aaa]local-user user1@huawei privilege level 0

CLIGURU-R1 cihazında AAA authentication modda telnet serverı etkinleştirelim.

[CLIGURU-R1]user-interface vty 0 4

[CLIGURU-R1-ui-vty0-4]authentication-mode aaa

CLIGURU-R1 cihazında telnet hizmetinin başarıyla kurulup kurulmadığını kontrol edelim.

<CLIGURU-R3>telnet 119.84.111.1

Trying 119.84.111.1 …

Press CTRL+K to abort

Connected to 119.84.111.1 …

Login authentication

Username:user1@huawei

Password:

<CLIGURU-R1>sys

<CLIGURU-R1>system-view

^

Error: Unrecognized command found at ‘^’ position.

<CLIGURU-R1>quit

3. CLIGURU-R3 cihazı için AAA konfigürasyonunu yapılandıralım.

[CLIGURU-R3]aaa

[CLIGURU-R3-aaa]authentication-scheme auth1

Info: Create a new authentication scheme.

[CLIGURU-R3-aaa-authen-auth1]authentication-mode local

[CLIGURU-R3-aaa-authen-auth1]quit

[CLIGURU-R3-aaa]authorization-scheme auth2

Info: Create a new authorization scheme.

[CLIGURU-R3-aaa-author-auth2]authorization-mode local

[CLIGURU-R3-aaa-author-auth2]quit

CLIGURU-R3’in domaini huawei olarak yapılandıralım, daha önce oluşturduğumuz kullanıcılara uygun olsun.

[CLIGURU-R3-aaa]domain huawei

[CLIGURU-R3-aaa-domain-huawei]authentication-scheme auth1

[CLIGURU-R3-aaa-domain-huawei]authorization-scheme auth2

[CLIGURU-R3-aaa-domain-huawei]quit

[CLIGURU-R3-aaa]local-user user3@huawei password cipher huawei

Info: Add a new user.

[CLIGURU-R3-aaa]local-user user3@huawei service-type telnet

[CLIGURU-R3-aaa]local-user user3@huawei privilege level 0

CLIGURU-R1 cihazında AAA authentication modda telnet serverı etkinleştirelim.

[CLIGURU-R3]user-interface vty 0 4

[CLIGURU-R3-ui-vty0-4]authentication-mode aaa

CLIGURU-R3 cihazında telnet hizmetinin başarıyla kurulup kurulmadığını kontrol edelim.

<CLIGURU-R1>telnet 119.84.111.3

Trying 119.84.111.3 …

Press CTRL+K to abort

Connected to 119.84.111.3 …

Login authentication

Username:user3@huawei

Password:

<CLIGURU-R3>system-view

^

Error: Unrecognized command found at ‘^’ position.

<CLIGURU-R3>

4. AAA konfigürasyonunun sonuçlarını bakalım.

<CLIGURU-R1>display domain name huawei

Domain-name : huawei

Domain-state : Active

Authentication-scheme-name : auth1

Accounting-scheme-name : default

Authorization-scheme-name : auth2

Service-scheme-name : –

RADIUS-server-template : –

HWTACACS-server-template : –

User-group : –

<CLIGURU-R1>display local-user username user1@huawei

The contents of local user(s):

Password : ****************

State : active

Service-type-mask : T

Privilege level : 0

Ftp-directory : –

Access-limit : –

Accessed-num : 0

Idle-timeout : –

User-group : –

<CLIGURU-R3>display domain name huawei

Domain-name : huawei

Domain-state : Active

Authentication-scheme-name : auth1

Accounting-scheme-name : default

Authorization-scheme-name : auth2

Service-scheme-name : –

RADIUS-server-template : –

HWTACACS-server-template : –

User-group : –

<CLIGURU-R3>display local-user username user3@huawei

The contents of local user(s):

Password : ****************

State : active

Service-type-mask : T

Privilege level : 0

Ftp-directory : –

Access-limit : –

Accessed-num : 0

Idle-timeout : –

User-group : –

Sonuç…

<CLIGURU-R1>display current-configuration

#

sysname CLIGURU-R1

#

aaa

authentication-scheme default

authentication-scheme auth1

authorization-scheme default

authorization-scheme auth2

accounting-scheme default

domain default

domain default_admin

domain huawei

authentication-scheme auth1

authorization-scheme auth2

local-user admin password cipher OOCM4m($F4ajUn1vMEIBNUw#

local-user admin service-type http

local-user user1@huawei password cipher ,fM\8+wUb#3@9_G-B0Y2lf”#

local-user user1@huawei privilege level 0

local-user user1@huawei service-type telnet

#

interface GigabitEthernet0/0/0

ip address 119.84.111.1 255.255.255.0

#

user-interface con 0

user-interface vty 0 4

authentication-mode aaa

user-interface vty 16 20

#

Return

<CLIGURU-R3>display current-configuration

#

sysname CLIGURU-R3

#

aaa

authentication-scheme default

authentication-scheme auth1

authorization-scheme default

authorization-scheme auth2

accounting-scheme default

domain default

domain default_admin

domain huawei

authentication-scheme auth1

authorization-scheme auth2

local-user admin password cipher OOCM4m($F4ajUn1vMEIBNUw#

local-user admin service-type http

local-user user3@huawei password cipher gQ+ZJr\.h/939O4.`(ZGxU:#

local-user user3@huawei privilege level 0

local-user user3@huawei service-type telnet

#

interface GigabitEthernet0/0/0

ip address 119.84.111.3 255.255.255.0

#

user-interface con 0

user-interface vty 0 4

authentication-mode aaa

user-interface vty 16 20

#

Return