According to RFC 2865:
A Network Access Server (NAS) operates as a client of RADIUS. The client is responsible for
passing user information to
designated RADIUS servers, and then acting on the response which is returned.
RADIUS servers are responsible for receiving user connection requests, authenticating the user,
and then returning all
configuration information necessary for the client to deliver service to the user.
RADIUS authentication is based on provisions of simple username/password credentials. These
credentials are encrypted
by the client using a shared secret between the client and the RADIUS server. OIG 2007, Page
513
RADIUS incorporates an authentication server and can make uses of both dynamic and static
passwords.
Since it uses the PAP and CHAP protocols, it also incluses static passwords.
RADIUS is an Internet protocol. RADIUS carries authentication, authorization, and configuration
information between a Network Access Server and a shared Authentication Server. RADIUS
features and functions are described primarily in the IETF (International Engineering Task Force)
document RFC2138
The term " RADIUS" is an acronym which stands for Remote Authentication Dial In User Service.
The main advantage to using a RADIUS approach to authentication is that it can provide a
stronger form of authentication. RADIUS is capable of using a strong, two-factor form of
authentication, in which users need to possess both a user ID and a hardware or software token to
gain access.
Token-based schemes use dynamic passwords. Every minute or so, the token generates a unique
4-, 6- or 8-digit access number that is synchronized with the security server. To gain entry into the
system, the user must generate both this one-time number and provide his or her user ID and
password.
Although protocols such as RADIUS cannot protect against theft of an authenticated session via
some realtime attacks, such as wiretapping, using unique, unpredictable authentication requests
can protect against a wide range of active attacks.
RADIUS: Key Features and Benefits
Features Benefits
RADIUS supports dynamic passwords and challenge/response passwords.
Improved system security due to the fact that passwords are not static.
It is much more difficult for a bogus host to spoof users into giving up their passwords or
password-generation algorithms.
RADIUS allows the user to have a single user ID and password for all computers in a network.
Improved usability due to the fact that the user has to remember only one login combination.
RADIUS is able to:
Prevent RADIUS users from logging in via login (or ftp).
Require them to log in via login (or ftp)
Require them to login to a specific network access server (NAS);
Control access by time of day.
Provides very granular control over the types of logins allowed, on a per-user basis.
The time-out interval for failing over from an unresponsive primary RADIUS server to a backup
RADIUS server is site-configurable.
RADIUS gives System Administrator more flexibility in managing which users can login from which hosts or devices.
Stratus Technology Product Brief http://www.stratus.com/products/vos/openvos/radius.htm
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Pages 43, 44
Also check: MILLER, Lawrence & GREGORY, Peter, CISSP for Dummies, 2002, Wiley Publishing, Inc., pages 45-46

The type of user access administration that is best suited to meet the organization's needs is hybrid. User access administration is the process that involves defining, implementing, and managing the access rights or permissions of the users or the roles that access a system or a network, using various methods, such as passwords, tokens, or biometrics. User access administration can be classified into four types, which are:
* Centralized: The access rights or permissions of the users or the roles are controlled and managed by a single authority or entity, such as a central server or a database, and are applied uniformly and consistently across the system or the network.
* Decentralized: The access rights or permissions of the users or the roles are controlled and managed by multiple authorities or entities, such as local servers or databases, and are applied differently and independently across the system or the network.
* Federated: The access rights or permissions of the users or the roles are controlled and managed by different authorities or entities, such as different organizations or domains, and are shared and exchanged across the system or the network, using a common standard or protocol, such as SAML or OAuth.
* Hybrid: The access rights or permissions of the users or the roles are controlled and managed by a combination of the above types, such as centralized and decentralized, or federated and decentralized, and are applied flexibly and adaptively across the system or the network. Hybrid user access
* administration is the type that is best suited to meet the organization's needs, as it can provide the benefits of both centralized and decentralized user access administration, such as efficiency, consistency, scalability, and flexibility. Hybrid user access administration can allow the organization to ensure that all new users have a predefined departmental access template applied upon creation, using a centralized user access administration, and to grant additional access for users on a per-project basis, using a decentralized user access administration12. References: CISSP CBK, Fifth Edition, Chapter 5, page 457; CISSP Practice Exam - FREE 20 Questions and Answers, Question 19.

Section: Software Development Security

Port forwarding via SSH (SSH tunneling) creates a secure connection between a local computer and a remote machine through which services can be relayed. Because the connection is encrypted, SSH tunneling is useful for transmitting information that uses an unencrypted protocol, such as IMAP, VNC, or IRC.