A network security administrator is tasked with implementing granular access control for network devices, ensuring that only authorized individuals can execute specific commands based on their roles. For example, junior administrators should only be able to view configurations, while senior administrators can modify them. Which protocol or framework is most suitable for achieving this level of command authorization and accounting?
- ATACACS+
- B802.1X
- CLDAP
- DRADIUS
Show answer & explanationAnswer & explanation
Correct answer: A. TACACS+
TACACS+ (Terminal Access Controller Access Control System Plus) is specifically designed to provide centralized Authentication, Authorization, and Accounting (AAA) services, with a strong emphasis on command-level authorization. It can restrict which commands a user can execute on a network device based on their role. RADIUS is primarily for network access authentication and does not offer the same granular command authorization. LDAP is a directory service. 802.1X is for port-based network access control.
Why the other options are wrong
- B. 802.1X is a port-based network access control protocol used for authenticating devices attempting to connect to a LAN, not for command authorization on the devices themselves.
- C. LDAP is a protocol for accessing directory services and is used for user authentication but does not directly provide command-level authorization on network devices.
- D. RADIUS is primarily focused on network access authentication and is less granular for command authorization on network devices.
TACACS+ Command Authorization
TACACS+ (Terminal Access Controller Access Control System Plus) is an AAA protocol that provides granular command-level authorization on network devices, allowing administrators to control which specific commands users can execute based on their roles.
- Centralized AAA protocol.
- Strong emphasis on command authorization.
- Separates authentication, authorization, and accounting.
Memory trick: AAA is like a bouncer (Auth), a manager (Authz), and a bookkeeper (Acct).