1 1 00:00:00,750 --> 00:00:03,180 Remote access, in this lesson, 2 2 00:00:03,180 --> 00:00:04,950 we're going to discuss a lot of the different types 3 3 00:00:04,950 --> 00:00:06,370 of remote access options 4 4 00:00:06,370 --> 00:00:08,490 that you may be supporting as a network technician 5 5 00:00:08,490 --> 00:00:10,240 or network administrator. 6 6 00:00:10,240 --> 00:00:11,990 These different methods will allow a client 7 7 00:00:11,990 --> 00:00:14,060 to access a server or a network device 8 8 00:00:14,060 --> 00:00:16,090 remotely over your network. 9 9 00:00:16,090 --> 00:00:17,380 Now, as an administrator, 10 10 00:00:17,380 --> 00:00:18,850 you're going to be using some of these methods 11 11 00:00:18,850 --> 00:00:21,380 to reach into the command line interface of your routers, 12 12 00:00:21,380 --> 00:00:23,240 your switches, and your firewalls as well. 13 13 00:00:23,240 --> 00:00:25,240 In order for you to be able to modify their settings 14 14 00:00:25,240 --> 00:00:28,130 and configurations as part of your job functions. 15 15 00:00:28,130 --> 00:00:31,050 Now, there are many ways to access this data remotely, 16 16 00:00:31,050 --> 00:00:34,120 and you can also control these devices remotely as well. 17 17 00:00:34,120 --> 00:00:36,280 Many of these, we may have already covered before 18 18 00:00:36,280 --> 00:00:37,910 in different videos in the course, 19 19 00:00:37,910 --> 00:00:39,950 but in this lesson, I want to provide you 20 20 00:00:39,950 --> 00:00:41,640 with a quick recap or summary. 21 21 00:00:41,640 --> 00:00:43,950 So you have them all covered in one place. 22 22 00:00:43,950 --> 00:00:46,090 And that way, you can use it as a great review 23 23 00:00:46,090 --> 00:00:47,980 before you take the exam. 24 24 00:00:47,980 --> 00:00:51,120 So in this lesson, we're going to discuss Telnet, 25 25 00:00:51,120 --> 00:00:55,830 SSH, RDP, RDG, VPN, VNC, 26 26 00:00:55,830 --> 00:00:58,770 VDI, in band versus out-of-band management 27 27 00:00:58,770 --> 00:01:02,240 and some authentication and authorization considerations. 28 28 00:01:02,240 --> 00:01:03,780 Now, the first thing we need to talk about 29 29 00:01:03,780 --> 00:01:06,640 with remote access technology is Telnet. 30 30 00:01:06,640 --> 00:01:09,740 Now Telnet operates on port 23 and Telnet 31 31 00:01:09,740 --> 00:01:12,690 is used to send text-based commands to remote devices. 32 32 00:01:12,690 --> 00:01:15,620 And it's considered a very old networking protocol. 33 33 00:01:15,620 --> 00:01:18,400 Everything you do in Telnet is going to be text-based 34 34 00:01:18,400 --> 00:01:20,970 and here, you can see that I'm connecting over Telnet 35 35 00:01:20,970 --> 00:01:23,700 to rainmaker.weather.underground.com. 36 36 00:01:23,700 --> 00:01:25,280 By doing this, I can then look up 37 37 00:01:25,280 --> 00:01:27,230 the daily weather for my area. 38 38 00:01:27,230 --> 00:01:29,550 Now, one of the biggest drawbacks to using Telnet 39 39 00:01:29,550 --> 00:01:31,280 is that it sends everything over the network 40 40 00:01:31,280 --> 00:01:33,980 in plain text or un-encrypted formats. 41 41 00:01:33,980 --> 00:01:35,920 Now, in this case, I really don't care 42 42 00:01:35,920 --> 00:01:37,560 that I'm sending things in plain text 43 43 00:01:37,560 --> 00:01:39,270 because the only information I have to send 44 44 00:01:39,270 --> 00:01:41,630 to the server is the three digit airport code 45 45 00:01:41,630 --> 00:01:43,890 for the city that I want to check the weather within. 46 46 00:01:43,890 --> 00:01:45,730 But if I'm going to send something private, 47 47 00:01:45,730 --> 00:01:48,190 like my social security number or my password 48 48 00:01:48,190 --> 00:01:50,500 or my credit card number, then I would never, 49 49 00:01:50,500 --> 00:01:52,390 ever want to use Telnet for that. 50 50 00:01:52,390 --> 00:01:54,430 Remember, Telnet should never, 51 51 00:01:54,430 --> 00:01:57,000 never not ever be used for anything 52 52 00:01:57,000 --> 00:01:59,520 when you're connecting to one of your secure devices, 53 53 00:01:59,520 --> 00:02:02,200 anything like a router or a switch or a firewall, 54 54 00:02:02,200 --> 00:02:03,740 because when you're configuring them, 55 55 00:02:03,740 --> 00:02:05,750 everything will be sent in plain text, 56 56 00:02:05,750 --> 00:02:08,810 including your commands, your username, your passwords, 57 57 00:02:08,810 --> 00:02:11,300 your access control lists, and all of that stuff. 58 58 00:02:11,300 --> 00:02:13,450 Instead, we always want to use an encrypted 59 59 00:02:13,450 --> 00:02:15,390 text-based remote access technology, 60 60 00:02:15,390 --> 00:02:17,310 something like Secure Shell. 61 61 00:02:17,310 --> 00:02:19,880 This brings us to our second remote access technology, 62 62 00:02:19,880 --> 00:02:21,600 which is Secure Shell. 63 63 00:02:21,600 --> 00:02:25,920 Now Secure Shell or SSH is going to operate over port 22. 64 64 00:02:25,920 --> 00:02:28,330 Secure Shell is also known as SSH, 65 65 00:02:28,330 --> 00:02:30,140 and it works just like Telnet, 66 66 00:02:30,140 --> 00:02:32,750 but it's going to encrypt everything that's being sent 67 67 00:02:32,750 --> 00:02:35,140 received between the client and the server, the router, 68 68 00:02:35,140 --> 00:02:37,380 or the switch that you're communicating with. 69 69 00:02:37,380 --> 00:02:39,610 Therefore, you're going to have much better security 70 70 00:02:39,610 --> 00:02:41,150 when you're using SSH 71 71 00:02:41,150 --> 00:02:42,700 than when you're using Telnet. 72 72 00:02:42,700 --> 00:02:44,270 Remember, anytime you need to connect 73 73 00:02:44,270 --> 00:02:45,910 to a networking device to configure it 74 74 00:02:45,910 --> 00:02:47,300 in the command line interface, 75 75 00:02:47,300 --> 00:02:49,900 you should always be doing this over SSH, 76 76 00:02:49,900 --> 00:02:51,210 using Secure Shell. 77 77 00:02:51,210 --> 00:02:53,190 This will ensure you have an encrypted connection 78 78 00:02:53,190 --> 00:02:54,710 to that device. 79 79 00:02:54,710 --> 00:02:57,110 The third remote access technology we need to discuss 80 80 00:02:57,110 --> 00:03:00,570 is known as RDP or the desktop protocol. 81 81 00:03:00,570 --> 00:03:02,190 Now the remote desktop protocol 82 82 00:03:02,190 --> 00:03:04,630 operates over port 3389 83 83 00:03:04,630 --> 00:03:07,670 and it's a proprietary protocol developed by Microsoft, 84 84 00:03:07,670 --> 00:03:09,880 which provides users with a graphical interface 85 85 00:03:09,880 --> 00:03:12,620 to connect to another computer over a network connection. 86 86 00:03:12,620 --> 00:03:14,440 While RDP is not really useful 87 87 00:03:14,440 --> 00:03:15,660 if you're trying to talk to a router, 88 88 00:03:15,660 --> 00:03:18,190 a switch or a firewall, it is really useful 89 89 00:03:18,190 --> 00:03:19,560 when you're trying to remotely access 90 90 00:03:19,560 --> 00:03:22,310 and control a windows server or client machine. 91 91 00:03:22,310 --> 00:03:24,810 For example, if your SIEM or network management system 92 92 00:03:24,810 --> 00:03:26,320 operates on a windows machine, 93 93 00:03:26,320 --> 00:03:28,770 you can RDP into it as a way to connect to it 94 94 00:03:28,770 --> 00:03:30,670 over your local area network. 95 95 00:03:30,670 --> 00:03:33,400 RDP is going to provide you with a graphical user interface 96 96 00:03:33,400 --> 00:03:35,630 known as a gui or GUI. 97 97 00:03:35,630 --> 00:03:37,830 This allows you to access a server and desktop 98 98 00:03:37,830 --> 00:03:40,230 and control it using your mouse and keyboard. 99 99 00:03:40,230 --> 00:03:42,160 Now, when you're remotely connected this machine, 100 100 00:03:42,160 --> 00:03:44,550 it's going to act just as if you were sitting in front of it, 101 101 00:03:44,550 --> 00:03:46,400 but you can do it from across the network 102 102 00:03:46,400 --> 00:03:48,130 or across the world. 103 103 00:03:48,130 --> 00:03:49,200 For example here, 104 104 00:03:49,200 --> 00:03:50,640 you can see there are three devices 105 105 00:03:50,640 --> 00:03:53,020 and they're all connecting to a windows seven machine. 106 106 00:03:53,020 --> 00:03:54,470 You have a Macintosh laptop, 107 107 00:03:54,470 --> 00:03:56,320 you have an iPad or an Android tablet, 108 108 00:03:56,320 --> 00:03:57,540 and you have a cell phone. 109 109 00:03:57,540 --> 00:03:59,240 And all of these are able to reach in 110 110 00:03:59,240 --> 00:04:01,670 and do the communication using RDP, 111 111 00:04:01,670 --> 00:04:03,570 just as if I had a mouse and keyboard 112 112 00:04:03,570 --> 00:04:05,780 sitting right in front of that workstation. 113 113 00:04:05,780 --> 00:04:07,970 RDP is going to allow you to connect to these devices 114 114 00:04:07,970 --> 00:04:10,390 from across your network or across the world, 115 115 00:04:10,390 --> 00:04:12,200 depending on how you have it configured. 116 116 00:04:12,200 --> 00:04:14,210 Now the remote desktop protocol itself 117 117 00:04:14,210 --> 00:04:16,670 is not considered to be a secure protocol. 118 118 00:04:16,670 --> 00:04:18,880 Instead, you need to secure that connection 119 119 00:04:18,880 --> 00:04:21,040 by using something else to tunnel it over. 120 120 00:04:21,040 --> 00:04:24,710 For example, you can use a remote desktop gateway or RDG 121 121 00:04:24,710 --> 00:04:26,110 to create a secure connection 122 122 00:04:26,110 --> 00:04:28,050 between you and that gateway 123 123 00:04:28,050 --> 00:04:30,340 and then tunnel into the RDP session. 124 124 00:04:30,340 --> 00:04:33,900 Or you can use a VPN, like a virtual private network. 125 125 00:04:33,900 --> 00:04:36,360 Now our fourth remote access technology we need to discuss 126 126 00:04:36,360 --> 00:04:39,640 is the RDG or the remote desktop gateway. 127 127 00:04:39,640 --> 00:04:42,210 Now a remote desktop gateway is a window server 128 128 00:04:42,210 --> 00:04:44,650 that's going to have the role of creating a secure connection 129 129 00:04:44,650 --> 00:04:49,470 using either SSL or TLS protocols to a server via RDP. 130 130 00:04:49,470 --> 00:04:53,080 So if you're using an RDG to secure RDP client, 131 131 00:04:53,080 --> 00:04:54,100 this will allow you to create 132 132 00:04:54,100 --> 00:04:55,920 those secure server connections. 133 133 00:04:55,920 --> 00:04:57,780 This way, you wouldn't have to run a VPN 134 134 00:04:57,780 --> 00:04:59,080 to create an encrypted tunnel, 135 135 00:04:59,080 --> 00:05:01,050 because RDG is already going to create 136 136 00:05:01,050 --> 00:05:04,590 that encrypted tunnel using SSL or TLS protocols. 137 137 00:05:04,590 --> 00:05:07,240 A remote desktop gateway provides several security features 138 138 00:05:07,240 --> 00:05:09,900 for you in terms of securing RDP connections. 139 139 00:05:09,900 --> 00:05:11,950 This includes things like creating encrypted tunnels, 140 140 00:05:11,950 --> 00:05:14,760 like a VPN would, controlling access to network resources 141 141 00:05:14,760 --> 00:05:16,550 based on permissions and group roles, 142 142 00:05:16,550 --> 00:05:18,740 maintaining and enforcing authorization policies 143 143 00:05:18,740 --> 00:05:20,620 and monitoring the status of the gateway 144 144 00:05:20,620 --> 00:05:23,580 and any RDP connections passing through that gateway. 145 145 00:05:23,580 --> 00:05:26,300 If you're running a windows server 2008 or newer, 146 146 00:05:26,300 --> 00:05:29,220 you definitely should be using this RDG 147 147 00:05:29,220 --> 00:05:30,630 or remote desktop gateway 148 148 00:05:30,630 --> 00:05:33,290 to better protect your RDP connections. 149 149 00:05:33,290 --> 00:05:35,940 Now the fifth remote access technology we need to talk about 150 150 00:05:35,940 --> 00:05:38,700 is VPNs or virtual private networks. 151 151 00:05:38,700 --> 00:05:41,470 A VPN is used to establish a secure connection 152 152 00:05:41,470 --> 00:05:43,120 between a client and a server 153 153 00:05:43,120 --> 00:05:46,310 over an untrusted public network like the internet. 154 154 00:05:46,310 --> 00:05:48,270 If you're going to use RDP over the internet, 155 155 00:05:48,270 --> 00:05:49,800 you first need to make sure you create 156 156 00:05:49,800 --> 00:05:52,430 a VPN connection to create a secure tunnel, 157 157 00:05:52,430 --> 00:05:56,670 and then run that RDP session over that VPN connection. 158 158 00:05:56,670 --> 00:05:59,170 We're going talk more about VPNs and their own lesson, 159 159 00:05:59,170 --> 00:06:00,960 including the three different types of VPNs 160 160 00:06:00,960 --> 00:06:02,370 and how to establish and maintain 161 161 00:06:02,370 --> 00:06:04,620 these secure connections over an untrusted network 162 162 00:06:04,620 --> 00:06:05,680 like the internet. 163 163 00:06:05,680 --> 00:06:08,140 The sixth remote access technology we need to discuss 164 164 00:06:08,140 --> 00:06:11,100 is VNC or virtual network computing. 165 165 00:06:11,100 --> 00:06:13,660 VNC operates over port 5900. 166 166 00:06:13,660 --> 00:06:16,060 It was originally designed for thin client architectures 167 167 00:06:16,060 --> 00:06:19,800 and things like virtual desktop infrastructure or VDI. 168 168 00:06:19,800 --> 00:06:22,397 VNC operates a lot like RDP, but unlike RDP, 169 169 00:06:22,397 --> 00:06:25,890 which only operates on Windows clients and servers, 170 170 00:06:25,890 --> 00:06:29,180 VNC is truly cross-platform and it can be used 171 171 00:06:29,180 --> 00:06:32,680 on Linux OSX or windows, clients and servers. 172 172 00:06:32,680 --> 00:06:34,350 Our seventh remote access technology 173 173 00:06:34,350 --> 00:06:37,930 to discuss is virtual desktop infrastructure or VDI, 174 174 00:06:37,930 --> 00:06:39,440 which I just mentioned that we use 175 175 00:06:39,440 --> 00:06:41,440 that with VNC a lot of times. 176 176 00:06:41,440 --> 00:06:43,190 Now virtual desktop infrastructure 177 177 00:06:43,190 --> 00:06:45,040 is used to host a desktop environment 178 178 00:06:45,040 --> 00:06:46,840 on a centralized server. 179 179 00:06:46,840 --> 00:06:48,960 VDI is a form of desktop virtualization 180 180 00:06:48,960 --> 00:06:50,396 and allows a specific desktop image 181 181 00:06:50,396 --> 00:06:52,430 to be run within a virtual machine 182 182 00:06:52,430 --> 00:06:55,260 and delivered to an end user over a network. 183 183 00:06:55,260 --> 00:06:57,230 In Cloud computing, we call this 184 184 00:06:57,230 --> 00:06:59,580 desktop as a service or DAS. 185 185 00:06:59,580 --> 00:07:02,080 Now when you're using VDI, you can access it 186 186 00:07:02,080 --> 00:07:05,010 through a virtual desktop either by using a web browser 187 187 00:07:05,010 --> 00:07:06,820 on a regular desktop or laptop, 188 188 00:07:06,820 --> 00:07:09,460 or you can use a specialized thin client device 189 189 00:07:09,460 --> 00:07:11,630 that uses a PXE network boot image 190 190 00:07:11,630 --> 00:07:13,340 to load up a specialized client 191 191 00:07:13,340 --> 00:07:15,030 that can connect to that centralized server 192 192 00:07:15,030 --> 00:07:17,580 and provide access to the virtual desktop. 193 193 00:07:17,580 --> 00:07:19,740 Our eighth remote access technology or concept 194 194 00:07:19,740 --> 00:07:21,950 that we need to talk about is known as in-band 195 195 00:07:21,950 --> 00:07:23,940 versus out-of-band management. 196 196 00:07:23,940 --> 00:07:26,430 Now, inbound management refers to managing devices 197 197 00:07:26,430 --> 00:07:30,010 through the use of Telnet or SSH protocols over the network. 198 198 00:07:30,010 --> 00:07:31,730 For example, if you're going to be using 199 199 00:07:31,730 --> 00:07:33,420 a workstation on your local area network 200 200 00:07:33,420 --> 00:07:34,960 to configure your land routers, 201 201 00:07:34,960 --> 00:07:37,190 you can connect to those using SSH 202 202 00:07:37,190 --> 00:07:40,090 by simply connecting to the gateway over port 22, 203 203 00:07:40,090 --> 00:07:42,320 this would be considered an in-band management 204 204 00:07:42,320 --> 00:07:43,730 because you're using the same network 205 205 00:07:43,730 --> 00:07:44,950 that you're configuring. 206 206 00:07:44,950 --> 00:07:47,020 Now out of band management on the other hand, 207 207 00:07:47,020 --> 00:07:48,970 is used when you have an alternate path 208 208 00:07:49,912 --> 00:07:51,272 or alternate management network 209 209 00:07:51,272 --> 00:07:52,105 to connect to the different network devices 210 210 00:07:52,105 --> 00:07:53,310 for configuring them. 211 211 00:07:53,310 --> 00:07:56,070 This is considered a best practice in security. 212 212 00:07:56,070 --> 00:07:58,730 For example, in the last large scale enterprise network 213 213 00:07:58,730 --> 00:08:00,760 I worked on, we had a production network 214 214 00:08:00,760 --> 00:08:02,300 with the users we're connected to, 215 215 00:08:02,300 --> 00:08:04,100 and everyone's workstations were there 216 216 00:08:04,100 --> 00:08:05,990 to be able to do their work on a daily basis 217 217 00:08:05,990 --> 00:08:08,010 and they can access our servers and the internet. 218 218 00:08:08,010 --> 00:08:10,230 From this network, you couldn't connect to the routers 219 219 00:08:10,230 --> 00:08:12,330 and switches in order to configure them though. 220 220 00:08:12,330 --> 00:08:14,540 Instead, we had a separate network 221 221 00:08:14,540 --> 00:08:16,000 called a management network, 222 222 00:08:16,000 --> 00:08:17,530 which was an out-of-band network. 223 223 00:08:17,530 --> 00:08:19,010 This was a more secure network 224 224 00:08:19,010 --> 00:08:20,620 and it was limited in its functions. 225 225 00:08:20,620 --> 00:08:22,570 If I need to configure the routers or switches, 226 226 00:08:22,570 --> 00:08:24,360 I would connect to the out-of-band network. 227 227 00:08:24,360 --> 00:08:25,770 And then I could talk to those routers 228 228 00:08:25,770 --> 00:08:27,520 and switches and configure them. 229 229 00:08:27,520 --> 00:08:29,260 Another out-of-band management connection 230 230 00:08:29,260 --> 00:08:31,560 would be if you had a laptop and you directly connected 231 231 00:08:31,560 --> 00:08:32,710 to the switch or router 232 232 00:08:32,710 --> 00:08:35,220 using a serial connection or a console port. 233 233 00:08:35,220 --> 00:08:37,210 Now this direct connection is going to be establishment 234 234 00:08:37,210 --> 00:08:38,880 you need to configure the router or switch. 235 235 00:08:38,880 --> 00:08:40,710 And when you're done doing that configuration, 236 236 00:08:40,710 --> 00:08:42,850 you'd unplug it and disconnect it. 237 237 00:08:42,850 --> 00:08:45,320 This is a truly out-of-band solution. 238 238 00:08:45,320 --> 00:08:47,470 Now the goal with using an out-of-band solution 239 239 00:08:47,470 --> 00:08:49,390 is to prevent a regular users machine 240 240 00:08:49,390 --> 00:08:51,420 from being able to connect to the management interfaces 241 241 00:08:51,420 --> 00:08:52,660 of your devices. 242 242 00:08:52,660 --> 00:08:55,870 This way, if a user's computer is taken over by an attacker, 243 243 00:08:55,870 --> 00:08:58,480 they would then be unable to cause large-scale havoc 244 244 00:08:58,480 --> 00:08:59,870 across your network. 245 245 00:08:59,870 --> 00:09:01,670 Now, by using an out-of-band network, 246 246 00:09:01,670 --> 00:09:03,120 you can provide separation of data 247 247 00:09:03,120 --> 00:09:04,350 between your production networks 248 248 00:09:04,350 --> 00:09:05,720 and your management networks, 249 249 00:09:05,720 --> 00:09:07,336 which gives you additional layers of security. 250 250 00:09:07,336 --> 00:09:10,730 Now out of networks do require additional configuration 251 251 00:09:10,730 --> 00:09:12,350 and equipment to implement though. 252 252 00:09:12,350 --> 00:09:14,150 if you want to be able to have a management network 253 253 00:09:14,150 --> 00:09:16,790 and a user network, you're going to need two sets of routers 254 254 00:09:16,790 --> 00:09:18,010 and two sets of switches. 255 255 00:09:18,010 --> 00:09:21,040 And all of that starts to get very expensive over time. 256 256 00:09:21,040 --> 00:09:22,950 Now it is considered a best practice, 257 257 00:09:22,950 --> 00:09:24,630 especially in large scale networks, 258 258 00:09:24,630 --> 00:09:26,690 where you can't physically walk to every single switch 259 259 00:09:26,690 --> 00:09:28,210 or router that you want to reconfigure. 260 260 00:09:28,210 --> 00:09:29,980 So in those cases, you definitely need 261 261 00:09:29,980 --> 00:09:31,600 to have a management network. 262 262 00:09:31,600 --> 00:09:34,020 Finally, we need to discuss some authentication 263 263 00:09:34,020 --> 00:09:35,570 and authorization considerations 264 264 00:09:35,570 --> 00:09:38,150 when dealing with these remote access technologies. 265 265 00:09:38,150 --> 00:09:39,670 When we're talking about authentication, 266 266 00:09:39,670 --> 00:09:41,560 we're referring to how a system will confirm 267 267 00:09:41,560 --> 00:09:43,400 that a user is who they say they are. 268 268 00:09:43,400 --> 00:09:46,250 Essentially, how are we going to validate their identity? 269 269 00:09:46,250 --> 00:09:48,020 Now, when we're talking about authorization, 270 270 00:09:48,020 --> 00:09:49,910 we're referring to how a system will give the user 271 271 00:09:49,910 --> 00:09:51,100 the proper permissions 272 272 00:09:51,100 --> 00:09:53,960 to access a particular resource on the network. 273 273 00:09:53,960 --> 00:09:55,330 Now there are lots of different ways 274 274 00:09:55,330 --> 00:09:57,250 to do remote access authentication, 275 275 00:09:57,250 --> 00:10:01,020 including PAP, CHAP, MS-CHAP and EAP, 276 276 00:10:01,020 --> 00:10:04,460 pap or PAP is the password authentication protocol. 277 277 00:10:04,460 --> 00:10:06,730 And it's a really old protocol that was never built 278 278 00:10:06,730 --> 00:10:07,970 with security in mind. 279 279 00:10:07,970 --> 00:10:09,610 In fact, when PAP is used, 280 280 00:10:09,610 --> 00:10:11,140 it's going to send the username and passwords 281 281 00:10:11,140 --> 00:10:14,540 for authentication in the clear, just like Telnet does. 282 282 00:10:14,540 --> 00:10:17,530 This makes PAP an insecure choice for any modern network 283 283 00:10:17,530 --> 00:10:19,310 and you simply should never use it 284 284 00:10:19,310 --> 00:10:20,860 in today's modern networks. 285 285 00:10:20,860 --> 00:10:22,610 You see, pap worked by having the clients 286 286 00:10:22,610 --> 00:10:23,840 send the username and password 287 287 00:10:23,840 --> 00:10:25,180 in the clear over the network, 288 288 00:10:25,180 --> 00:10:27,910 then the server would send an authentication acknowledgement 289 289 00:10:27,910 --> 00:10:30,590 if the credentials matched what they expected to receive, 290 290 00:10:30,590 --> 00:10:33,624 or they would get an authentication NEC 291 291 00:10:33,624 --> 00:10:36,180 or a non acknowledgement if the credentials were incorrect. 292 292 00:10:36,180 --> 00:10:37,960 So why am I even mentioning PAP 293 293 00:10:37,960 --> 00:10:39,580 if we never use it these days? 294 294 00:10:39,580 --> 00:10:42,060 Well, because after PAP came CHAP, 295 295 00:10:42,060 --> 00:10:43,620 which was an evolution to PAP, 296 296 00:10:43,620 --> 00:10:45,270 and it helps to understand PAP 297 297 00:10:45,270 --> 00:10:47,290 before you start talking about CHAP. 298 298 00:10:47,290 --> 00:10:49,120 Now, CHAP is considered the challenge, 299 299 00:10:49,120 --> 00:10:51,352 handshake authentication protocol, CHAP. 300 300 00:10:51,352 --> 00:10:54,880 And it's an improvement over PAP that attempted to solve 301 301 00:10:54,880 --> 00:10:56,250 this problem with sending our credentials 302 302 00:10:56,250 --> 00:10:58,370 over the network in plain text. 303 303 00:10:58,370 --> 00:11:00,240 With CHAP, the server sends the client 304 304 00:11:00,240 --> 00:11:02,850 a string of random texts called a challenge. 305 305 00:11:02,850 --> 00:11:05,360 This random text is then encrypted by the client 306 306 00:11:05,360 --> 00:11:06,500 using their password. 307 307 00:11:06,500 --> 00:11:08,010 And then they send that encrypted message 308 308 00:11:08,010 --> 00:11:09,250 back to the server. 309 309 00:11:09,250 --> 00:11:10,840 The server will then unencrypt 310 310 00:11:10,840 --> 00:11:12,180 the text received from the client 311 311 00:11:12,180 --> 00:11:14,650 using the stored password on that server. 312 312 00:11:14,650 --> 00:11:16,400 And if those things match, 313 313 00:11:16,400 --> 00:11:19,530 that means that that client really did have the password. 314 314 00:11:19,530 --> 00:11:22,290 And so it's a match and they would be authenticated. 315 315 00:11:22,290 --> 00:11:23,630 Now by using this method, 316 316 00:11:23,630 --> 00:11:25,960 the passwords never actually send across the network. 317 317 00:11:25,960 --> 00:11:27,580 Only this encrypted text. 318 318 00:11:27,580 --> 00:11:30,170 This allows us to positively identify the user 319 319 00:11:30,170 --> 00:11:32,990 using authentication while maintaining security. 320 320 00:11:32,990 --> 00:11:36,320 Now CHAP and MS CHAP were used for many, many years. 321 321 00:11:36,320 --> 00:11:38,140 And both of these though have been overtaken 322 322 00:11:38,140 --> 00:11:40,630 by a newer protocol known as EAP, 323 323 00:11:40,630 --> 00:11:43,010 the extensible authentication protocol. 324 324 00:11:43,010 --> 00:11:44,940 Now the extensible authentication protocol 325 325 00:11:44,940 --> 00:11:47,780 or EAP allows for more secure authentication methods 326 326 00:11:47,780 --> 00:11:50,690 to be used instead of just using a username and password. 327 327 00:11:50,690 --> 00:11:52,990 With EAP, we can use a username and password, 328 328 00:11:52,990 --> 00:11:55,340 or we can use things like smart cards, 329 329 00:11:55,340 --> 00:11:57,370 Kerberos and digital certificates. 330 330 00:11:57,370 --> 00:11:59,370 In modern remote access implementations, 331 331 00:11:59,370 --> 00:12:02,510 you should be using EAP TLS for your authentication 332 332 00:12:02,510 --> 00:12:05,083 in conjunction with a RADIUS or TACACS+ server.