Cisco Systems Servers Manuale Utente

There are several basic password configurations:

These configurations are all classed as inbound authentication.

Single password for ASCII/PAP/CHAP/MS-CHAP/ARAP—This is the 
most convenient method for both the administrator when setting up accounts 
and the user when obtaining authentication. However, because the CHAP 
password is the same as the PAP password, and the PAP password is 
transmitted in clear text during an ASCII/PAP login, there is the chance that 
the CHAP password can be compromised.

Separate passwords for ASCII/PAP and CHAP/MS-CHAP/ARAP—For a 
higher level of security, users can be given two separate passwords. If the 
ASCII/PAP password is compromised, the CHAP/ARAP password can 
remain secure.

External user database authentication— For authentication by an external 
user database, the user does not need a password stored in the CiscoSecure 
user database. Instead, Cisco Secure ACS records which external user 
database it should query to authenticate the user.

In addition to the basic password configurations listed above, Cisco Secure ACS 
supports the following:

Inbound passwords— Passwords used by most Cisco Secure ACS users. 
These are supported by both the TACACS+ and RADIUS protocols. They are 
held internally to the CiscoSecure user database and are not usually given up 
to an external source if an outbound password has been configured.

Outbound passwords—The TACACS+ protocol supports outbound 
passwords that can be used, for example, when a AAA client has to be 
authenticated by another AAA client and end-user client. Passwords from the 
CiscoSecure user database are then sent back to the second AAA client and 
end-user client.

Token caching—When token caching is enabled, ISDN users can connect 
(for a limited time) a second B Channel using the same OTP entered during 
original authentication. For greater security, the B-Channel authentication