What is Local Authentication?

Understanding Local Authentication

Local authentication is the process of verifying a user's or device's identity using credentials stored on the system itself, rather than against a centralized service such as Active Directory, LDAP, or a RADIUS server. The device holds and checks the authentication data — passwords, password hashes, biometrics, or tokens — entirely within its own self-contained environment.

In practice the system maintains a local credential store and compares supplied credentials against it. On Linux, password hashes live in /etc/shadow and are checked by PAM; on Windows, local accounts are stored in the SAM database; network devices keep local username/password entries in their configuration. Modern implementations store salted hashes (or use a TPM/secure enclave for biometrics) rather than plaintext, and grant access only on a successful match.

Local authentication matters because it provides a fallback and a baseline of access control that survives network or directory outages — critical for break-glass access to routers, servers, and recovery consoles when the central authentication server is unreachable. Its weakness is scale and oversight: local accounts are managed per device, so password policy, rotation, deprovisioning, and centralized logging are hard to enforce. Orphaned or shared local accounts are a common attack path, and offline theft of a hash store (e.g., dumping the SAM) enables password cracking.

For example, a network engineer configures a switch with a local enable secret and a local admin account so that if the RADIUS server fails, staff can still log in to the device console. The same local account, if left with a weak or default password, is exactly what an attacker would target to gain a foothold — which is why local credentials are tightly controlled and reserved as emergency access.