A-21
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix A System Architecture
MainApp
AuthenticationApp to authenticate the identity of the user. The control transaction request typically
includes the username and a password, or the identity of the user can be authenticated using an SSH
authorized key.
The AuthenticationApp responds to the execAuthenticateUser control transaction request by attempting
to authenticate the identity of the user. The AuthenticationApp returns a control transaction response tha t
contains the authentication status and privileges of the user. If the identity of the user cannot be
authenticated, the AuthenticationApp returns an unauthenticated status and anonymous user privileges
in the control transaction response. The control transaction response also indicates if the account
password has expired. User interface applications that authenticate users by initiating an
execAuthenticateUser control transaction prompt the user to change the password.
The AuthenticationApp uses the underlying operating system to confirm the identity of a user. All the
IPS applications send control transactions to the AuthenticationApp, which then uses the operating
system to form its responses.
Remote shell services, Telnet and SSH, are not IPS applications. They call the operating system directly.
If the user is authenticated, it launches the IPS CLI. In this case, the CLI sends a special form of the
execAuthenticateUser control transaction to determine the privilege level of the logged-in user. The CLI
then tailors the commands it makes available based on this privilege level.
Managing TLS and SSH Trust Relationships
Encrypted communications over IP networks provide data privacy by making it impossible for a passive
attacker to discover from the packets exchanged alone the secr et key needed to decrypt the data in the
packets.
However, an equally dangerous attack vector is for an imposter to pretend to be the server end of the
connection. All encryption protocols provide a means for clients to defend themselves from these
attacks. IPS supports two encryption protocols, SSH and TLS, and the Authen ticationApp helps manage
trust when the sensor plays either the client or server role in encrypted communications.
The IPS web server and SSH server are server endpoints of encrypted comm unications. They protect
their identities with a private key and offer a public key to clients that connect to them. For TLS this
public key is included inside an X.509 certificate, which includes other information. Remote systems
that connect to the sensor should verify that the public key received during connection establishment is
the key they expect.
Clients must maintain a list of trusted public keys to protect themselves from man-in-the-middle attacks.
The exact procedure by which this trust is established varies depending on the protocol and client
software. In general, the client displays a fingerprint of 16 or 20 bytes. The human operator who is
configuring the client to establish trust should use an out-of-band method to learn the key fingerprints
of the server before attempting to establish trust. If the fingerprints match, the trust relationship is
established and henceforth the client can automatically connect with that server and be confident that the
remote server is not an imposter.
You can use the show ssh server-key and show tls fingerprint to display the key fingerprints of the
sensor. By recording the output of these commands when directly connected to the sensor console, you
can reliably use this information to confirm the identity of the sensor over the network later when
establishing trust relationships.
For example, when you initially connect to a sensor through the Microsoft Internet Explorer web
browser, a security warning dialog box indicates that the certificate is not trusted. Using the user
interface of Internet Explorer, you can inspect the certificate thumbprint, a value that should exactly
match the SHA1 fingerprint displayed by the show tls fingerprint command. After verifying this, add
this certificate to the list of trusted CAs of the browser to establish permanent trust.