Hello,
> So PIX puts all of its trust in TACACS and Radius? If the authentication
> server runs on a different machine, that would mean the firewall trusts
> something. Having the firewall trust *ANYTHING* is bad bad bad.
I think it is actually a good idea to store NO authentication data on the
firewall. I don't see a problem with a trusted authentication servers. Of
course this piece of hardware needs to be additionally secured and should be
on its own secure net.
This is how more secure systems like SecureId or
Kerberos works. They all need a trusted Authentication Server.
Greetings
Bernd
--
(OO) -- Bernd_Eckenfels @
Wittumstrasse13 .
76646Bruchsal .
de --
( .. ) ecki @
{inka .
de,linux.de,debian.org} http://home.pages.de/~eckes/
o--o *plush* 2048/93600EFD eckes @
irc +4972573817 BE5-RIPE
(O____O) If privacy is outlawed only Outlaws have privacy
References:
|
|
