CertiGuide to Security+  9  Chapter 2:  Communication Security (Domain 2.0; 20%)       9  2.1  Remote Access

2.1.3  RADIUS 1 2.1.5  L2TP/PPTP

TACACS is the Terminal Access Controller Access Control System, another client/server user authentication protocol similar to RADIUS, which works similarly to RADIUS. For authentication, it allows use of user/password information, Kerberos-style authentication that does not require keys being passed over the wire, or even dynamic password systems in which smart cards are used to generate one-time passwords.

Over the years, three generations of TACACS have been developed:

• TACACS, the original, which performs authentication and authorization.
  
  
• XTACACS, or Extended TACACS, which separates the tasks of authentication, authorization and accounting/logging.
  
  
• TACACS+, developed by Cisco, which builds on XTACACS by adding a two-factor user authentication (proving that a user is who they say they are through both something they know, like a password, and something they have, like a smart card), system and encrypting all client/server communication.

TACACS+ has some security vulnerabilities that may concern you if end-users have access to the network over which TACACS+ traffic travels:

• Since accounting information is sent in clear text, and, the only verification performed is that the received accounting record packet length = the length that was sent, someone could intercept the communication and alter it or inject spurious accounting records.
  
  
• Encryption is potentially vulnerable due to the small size of the session id key used for encryption.
  
  
• Lengths of user passwords can be determined by watching traffic, because, the protocol provides for sending a password only as long as there are characters in the password.
  
  
• Theoretical issues with MD5 hashes (see section 1.4.10 on Birthday attacks, and chapter 4 on cryptography)
  
  A handful of overflow/resource hogging vulnerabilities in some popular implementations of the protocol, which can lead to denial of service¹⁴⁶
  
  
• TACACS+ uses a Kerberos-style authentication mechanism that doesn’t require keys to be sent over the wire, but potentially leaves it vulnerable to similar exploits as Kerberos

2.1.3  RADIUS 1 2.1.5  L2TP/PPTP