Lesson 4.2: Authentication, authorisation, accounting and MFA
Identification says who you claim to be, authentication proves it, authorisation decides what you may do and accounting records what you did (AAA). Authentication factors (something you know, have, are) and why multi-factor authentication stops most password attacks. In the lab you harden an SSH server so that only keys work and root can't log in directly, then use the login records to find an account that was used from an unknown address at 3 a.m. and lock it.
18 min
You will learn to
- Tell identification, authentication, authorisation and accounting apart
- Name the three authentication factors and explain MFA
- Turn off root login and password login for SSH safely
- Read login records with last and the authentication log
- Lock a suspicious account
Key terms
- Identification
- Saying who you are, usually with a user name.
- Authentication
- Proving that claim.
- Authorisation
- Deciding what an authenticated user may do.
- Accounting
- Recording who did what and when, so actions can be traced afterwards.
- Authentication factor
- A kind of proof: something you know (password, PIN), something you have (phone, security key) or something you are (fingerprint, face).
- Multi-factor authentication (MFA)
- Requiring proofs from at least two different factors.
- SSH key
- A pair of files: a private key you keep and a public key you put on the server. Logging in proves you hold the private key without sending it.
← Spaces in paths and file names · All lessons · Wildcards and path expansion →