Making sense of remote access

ANALYSIS

Setting up remote access servers and connections in Windows can be somewhat overwhelming and confusing if you don't understand the protocol configuration options involved. You have a number of remote access protocol options to choose from, and deciding which ones to use will depend on the functionality you need, your system configuration, and your hardware and communications capabilities. To help make sense of all these options, we'll take a look at the categories of protocols and the advantages and disadvantages of the various protocols within each one. Categories and choices
First, you need to consider two distinct methods of remote access, each of which uses different protocols:

Dial-up
Virtual private networking (VPN)

Within each method, there are three basic categories for protocols:

Connectivity
Authentication
Data encryption

In making decisions about which protocol to use, you must remember two things. First, you want the best security you can provide for the remote session. You want authentication to be encrypted so that someone who is snooping cannot see it, and you want the data that is passed in the remote session to be encrypted for the same reason. Second, older systems and their associated protocols are less capable in terms of encryption than newer systems, so you need to be aware of when you may have to use the older protocols and what you're giving up when you do. Let's take a look at the protocols for dial-up connectivity, authentication, and encryption. Then, we will do the same for VPN remote access. Dialing up a connection
Dial-up involves one modem connecting with another over the Public Switched Telephone Network (PSTN), creating a temporary, dedicated WAN link. There are three possible protocols for making the initial connection: Point-to-Point Protocol (PPP), Serial Line Internet Protocol (SLIP), and Asynchronous NetBEUI (AsyBEUI). Table A explains their differences. Table A

DIAL-UP CONNECTIVITY
PROTOCOL	WHEN USED	NOTES
Point-to-Point Protocol (PPP)	PPP is almost always the protocol of choice for both server and client. It is required if encryption is to be used in the dial-up session.	Supports TCP/IP as well as other LAN protocols such as IPX/SPX, AppleTalk, and DECnet.
Serial Line Internet Protocol (SLIP)	SLIP is used as a client in NT or Win2K only when necessary to connect to an older server that is not supporting PPP.	Allows TCP/IP connections only and does not support WINS or DHCP.
Asynchronous NetBEUI (AsyBEUI)	This is a Microsoft proprietary remote access protocol used only for legacy systems such as early versions of Windows NT, Windows for Workgroups, or DOS.	Supports only the NetBEUI LAN protocol.

Authenticating the user
Part of the dial-up process involves authentication, usually by providing a password. Since that password can be intercepted and used to gain unauthorized access, it should be encrypted using the strongest possible method that is supported by both the server and the client. It's important to remember that PPP is the only dial-up protocol that supports encryption. If you must use SLIP or AsyBEUI, the only authentication protocol you can use is PAP. Table B outlines the differences between the available authentication protocols. Table B

DIAL-UP AUTHENTICATION
PROTOCOL	WHEN USED	NOTES
Password Authentication Protocol (PAP)	Used only when the server requires a plaintext password.	This protocol passes the password without encryption and so is not secure.
Shiva Password Authentication Protocol (SPAP)	Developed as an improvement to PAP for use with Shiva LAN Rover products.	Uses a very weak encryption scheme.
Challenge Handshake Authentication Protocol (CHAP)	Probably the most commonly used dial-up protocol for authentication.	Uses reversibly encrypted passwords for greater security. However, the passwords are stored on the RAS server in plaintext.
Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) Version 1	As a Microsoft proprietary protocol, MS-CHAP was developed for use with the Windows operating system.	Similar to CHAP but allows storage of passwords on the server in encrypted format.
Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) Version 2	As a Microsoft proprietary protocol, MS-CHAP was developed for use with the Windows operating system.	Similar to MS-CHAP Version 1 but requires mutual authentication and different encryption keys when sending and receiving, and so is more secure than MS-CHAP v. 1.
Extensible Authentication Protocol (EAP)	EAP was designed as an extension to PPP to be able to use newer authentication methods such as one-time passwords, smart cards, or biometric techniques.	There are two different types of EAP, and both the server and client must be using the same type: · EAP-MD5 CHAP Used primarily for password-based security· EAP-TLS Used primarily for certificate-based security.

« Previous
1
2
Next »

Talkback

Can I use my home printer when using remote access?

via Facebook 16 March, 2005 10:27

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

I also installed the KDE version; I also will probably try out razorqt since I really haven't had a chance to before. I'm looking forward to the...

2 hours ago by Thomas Gellhaus via Facebook on Mageia 2 Released

Acquiring when reinvention/cannibalization is too challenging for a large organization can be an excellent strategy- still, so many mergers stumble...

5 hours ago by francisabigail on Ariba buy parks SAP on Oracle's cloud turf

All of the feedback regarding using a touch monitor for a desktop PC is right on. Several months ago, we installed a "demo" multitouch all-in-one...

10 hours ago by apexwm on Windows 8 could speed multi-monitor uptake

anyone wanting to triple boot *their* own Mac

11 hours ago by 191706 on xTreme Triple Booting: Linux, Mac & Windows

Cont.. Biggest Bugbear: Win7's stop-animate-go approach to work, you develop a staggered (not in the above alchohol sense of the word) approach to...

11 hours ago by SoapyTablet on Windows 8 could speed multi-monitor uptake

Ah the joys of Windows 8 Consumer Preview... If Windows 7 was 'Vista with Lipstick', whats Windows 8? Vista with Lipstick, the morning after?...

11 hours ago by SoapyTablet on Windows 8 could speed multi-monitor uptake

Though the metro look is quite cool on the windows mobile platform I think that think that microsoft ARE MESSING THINGS UP because what has they...

12 hours ago by daveveej on Windows 8 could speed multi-monitor uptake

I agree, we have a few touch screen monitors in work but as Windows7 and the applications we use are not touch screen friendly (the size of the...

12 hours ago by Custonian on Windows 8 could speed multi-monitor uptake

I find it amusing that Microsoft added the mouse, which was deemed awkward, but people were forced to use it so it stuck, and now they're saying,...

15 hours ago by archerthom on Windows 8 could speed multi-monitor uptake

Agree with other comments. Nobody's going to start reaching out to start tapping their desktop monitors with their fingers. Their arms would tire...

23 hours ago by BrownieBoy on Windows 8 could speed multi-monitor uptake

The only way a touch monitor would be any good is if it were horizontal on the desk, with a virtual keyboard so you could do away with that as well...

1 day ago by Random_Error on Windows 8 could speed multi-monitor uptake

This is just dumb! Forget that I think Windows 8 will bomb, but really, people are going to go out and buy touch Monitors now??? Just pretend...

1 day ago by JBDragon on Windows 8 could speed multi-monitor uptake