- [Instructor] Servers part four, authentication servers.
An authentication server acts as a central repository
of user accounts and computer accounts on the network.
All users log on to this server.
The information about the users
can be shared with other servers as well.
So here in our illustration we have an example.
We've added another server here,
the authentication server to our LAN.
And quite often in a lot of companies
this will be a Windows Server that has been promoted
and has become a domain controller.
And all the users at these computers log onto that server.
And that server takes care of the authentication,
verifying the username and passwords of those users
and making sure those computers are allowed access
to the domain as well.
But the authentication server could also be on the internet.
If you have multiple offices or if you have a smaller office
and you don't wanna run an authentication server locally,
you could run that on the cloud
with a provider, a cloud provider, or possibly something
that you've placed in another location.
So it could be on the internet or it could be in the LAN.
Larger companies will quite often have them
on the Local Area Network.
And what this does is it speeds up
the authentication process.
Without the internet involved,
all of these computers and users logging in
will have a faster, more efficient process
if the authentication server is on the LAN
but that increases the manpower needed to maintenance,
to maintain and take care of that server.
Generally, small companies, small offices, home offices,
will not have an authentication server
'cause it's really not necessary
but larger companies will require this
in order to centralize the user accounts
and keep everything nice and organized.
And especially if you're gonna have file servers
that you wanna have hundreds of people
connecting to at the same time, that authentication server,
that domain controller in Windows networks
will allow for this, it'll facilitate the quick and easy
and efficient connections that are necessary.
Now, the authentication server uses one or more
authentication protocols.
For example, LDAP,
that's the Lightweight Directory Access Protocol.
This is a vendor-neutral standard
used to access directory information services.
Various types of software use it,
for example Windows Servers that have been promoted
to domain controllers.
It's standardized by the IETF
and published as a request for comments RFC 4511.
It's based on the X.500 standard.
And it's sometimes called X.500 light.
Another one is Kerberos.
This is another type of authentication protocol.
If you have an insecure network by default,
but you want your computers to prove their identity
to an authentication server in a secure manner,
then Kerberos can be the solution.
It uses tickets and symmetric encryption
to authenticate computers.
An example of an authentication server that runs LDAP
and possibly uses Kerberos as well is Windows Server.
Let's show an example of this
and we'll go to our Server 2012 here.
And we're in the Server Manager
and originally this was just a file server.
That's all it was when I first installed it
and that's what you get by default.
But I wanted to create a domain.
And if you want to create a domain
or connect to a preexisting domain,
then you'd have to install Active Directory.
And that's the full name, Active Directory Domain Services.
So I did that, I did a promotion to promote that server
to a domain controller.
And to do that, we also needed DNS
because Active Directory
needs to actually look to a DNS server.
So this is running both of those.
But the DNS server could be a separate box
on the Local Area Network,
could be a separate box out on the internet.
In many large companies,
they will be in the same server room.
They might be separate boxes
but they'll be in the same server room or data center.
So we install that Active Directory and that installs LDAP,
the Lightweight Directory Access Protocol,
and runs that to help with our directory services
and the information about users and computers.
So to take a look at that, we can do a couple things here.
We can go to Tools
and we can go to all the Active Directory snap-ins
that we have here or console Windows that we have here.
For example, Active Directory Users and Computers.
And when we bring that up,
we'll see our domain which we created
when we promoted this server to a domain controller,
when we first created this domain,
and we see all of the objects in here
including computers and especially users.
I like to take these console Windows
and snap them into an MMC.
Which I've already done, created this MMC
and here we have it,
here is the Active Directory Users and Computers.
And if we open that, we'll see our domain.
And if we open that, we'll see the same information
that we saw in that console window.
And if we go to Users, we'll see all the user accounts
and groups of users that are able to log on to this domain.
User A, user B, user C, test users, we've got Alice,
we've got all this stuff, a group called IT 1,
all these are users that have the ability
to log onto the domain.
And this server takes control of all that authentication,
the username and password process.
It logs who actually tries to connect and when,
all that good stuff.
We also have our computers that are allowed to connect.
For example, this laptop and this virtual machine,
and this NAS box, they are all allowed
to connect into this domain.
So the LDAP protocol takes care of all this.
It allows us to keep all this information
in an organized fashion.
That's all part of Directory Services.
It's all part of Active Directory.
In Windows Server that's been promoted
to a domain controller.
Let's go to our PowerShell here
and we'll run a couple commands.
First, we'll run the netstat-n command.
And you'll see the sessions that are running,
the established sessions running within TCP on this system.
One of those is LDAP
which runs on port 389.
It's internal, it's the same IP address
for the local and the foreign but that is established.
That is something that is running on this system.
It has to be running, LDAP has to be running
on port 389 in order to allow
for Active Directory connections and user log-ons and so on.
Now, if we do a netstat-an,
we'll get all the information, TCP and UDP,
which I'm gonna break out of and scroll back up here
and this will show not only the established connections
like 389 here, LDAP,
but also anything that is listening,
any protocols that are running that are listening
and ready for connections.
For example Kerberos on port 88 which we can make use of
in Windows Server domain controllers as well.
So both of those are actually installed.
Those protocols are installed when we promote this server
to a domain controller which is just one example
of an authentication server.
Now, authentication servers can also be used
for connecting over a VPN.
For example, if there's users out on the internet
and they wanna connect securely through VPN,
a Virtual Private Network, through to our router
or firewall or whatever device and get into our LAN
to try to log in or get access to servers or who knows what.
And there are some examples of authentication servers
that can be used for that, for example RADIUS and TACACS.
So there are a variety
of different authentication servers available
but the A+ exams will focus the most
on domain controllers in Windows-based networks.