Authentication, Authorization, and Accounting
Learn how the AAA framework controls who accesses systems, what they can do, and how actions are tracked.
Authentication, Authorization, and Accounting is a free Cloud & IT Cert Prep lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cloud & IT Cert Prep learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Introducing the AAA Framework
The AAA framework runs access control everywhere. Authentication asks "who are you?", authorization asks "what can you do?", and accounting asks "what did you do?"
Authentication: Proving Your Identity
Authentication proves you are who you claim — using something you know, have, or are. Combining two of these is MFA, and it stops most stolen-password attacks.
Common Authentication Methods
Common methods range from weak to strong: passwords, certificates on smart cards, Kerberos tickets in Active Directory, and RADIUS for network and VPN access.
# Example: SSH key-based authentication (something you have)
# Generate key pair
ssh-keygen -t ed25519 -C 'user@company.com'
# Copy public key to server
ssh-copy-id user@server.example.com
# Now authenticate without a passwordAuthorization: What You Can Access
Authorization happens after login and decides what you can touch. The golden rule is least privilege: grant only the minimum access each person needs.
# Linux file permissions example
# Owner can read/write, group can read, others have no access
chmod 640 sensitive_report.txt
# Verify with ls -l
ls -l sensitive_report.txt
# -rw-r----- 1 alice finance 1024 Jun 01 sensitive_report.txtAuthorization Models Overview
Three models decide who gets access: DAC lets owners share, MAC enforces labels and clearances, and RBAC ties permissions to roles for easy scaling.
Accounting: Tracking Every Action
Accounting records what users do, so actions can be traced back to a person. That's non-repudiation — they can't deny it when the logs prove it.
# View authentication logs on Linux
tail -f /var/log/auth.log
# Look for entries like:
# Jun 01 10:15:32 server sshd[1234]: Accepted publickey for alice from 192.168.1.5
# Jun 01 10:16:45 server sudo[5678]: alice : TTY=pts/0 ; COMMAND=/bin/cat /etc/shadowRADIUS and TACACS+ Protocols
Two protocols power AAA for networks. RADIUS uses UDP and is standard for Wi-Fi and VPNs. TACACS+ uses TCP and encrypts everything — great for device admin.
Single Sign-On and AAA
Single Sign-On (SSO) lets you log in once and reach many systems. It cuts password fatigue and relies on trust between an identity provider and each app.
Accountability and Non-Repudiation
Non-repudiation means you can't deny an action you took. It combines authentication (who) with accounting (what), and digital signatures lock it in tight.
Log Management Best Practices
Good logs must be complete, tamper-evident, and time-synced with NTP so events line up across systems. Keep them long enough for any future investigation.
# Configure NTP for accurate log timestamps
timedatectl set-ntp true
# Verify synchronization
timedatectl status
# Send logs to remote syslog server
echo '*.* @@192.168.1.10:514' >> /etc/rsyslog.conf
systemctl restart rsyslogAAA in Network Access Control
AAA powers Network Access Control: when a device joins, it's authenticated by a RADIUS server, placed in the right VLAN, and every attempt is logged.
Quick Check
Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.
Lesson Recap
Quick recap: Authentication proves identity, Authorization sets what you can do, and Accounting records it all. Next up: non-repudiation and security controls.
Frequently asked questions
Is the “Authentication, Authorization, and Accounting” lesson free?
Yes — the full text of “Authentication, Authorization, and Accounting” is free to read here on the web, and the Cloud & IT Cert Prep course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cloud & IT Cert Prep course, upgrade to CoddyKit PRO.
What will I learn in “Authentication, Authorization, and Accounting”?
Learn how the AAA framework controls who accesses systems, what they can do, and how actions are tracked. You practise Cloud & IT Cert Prep with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cloud & IT Cert Prep?
No prior experience is required. Cloud & IT Cert Prep on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Authentication, Authorization, and Accounting” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cloud & IT Cert Prep lesson?
Yes. Every Cloud & IT Cert Prep lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Confidentiality, Integrity, and Availability
- Authentication, Authorization, and Accounting
- Non-Repudiation and Security Controls
- Security Roles and Responsibilities