Re: RE : [midcom] More on new work item

Joel Tran wrote:

>>There is a serious trust issue here. Is the ISP really going to issue a 
>>username and password to every user of their network, entrusting them 
>>with permissions to use midcom to manage port bindings on their network 
>>wide NAT?? I certainly hope not. Thats an open invitation for 
>>substantial denial of service attacks.
>>
>>-Jonathan R.
> 
> 
> Correct me if I'm wrong. I don't think it is an open invitation for DOS attack 
> if there is a proper Access Control List/Policy Rule in the Midcom device which 
> may limit the use of the port bindings for each user. 

I don't think this can work easily.

How would the ACL be structured? Presumably, you'd want to say something 
like, "user joe is allowed to open up pinholes directed to his currently 
allocated IP address". There are several major problems here:

* if there is any other NAT intervening the user and the ISP's nat (very 
common here in the US at least, due to residential NAT devices like 
those made by linksys), this of course won't help even if you work out 
the ACL issues

* assuming no other nats between the user and the ISP NAT, there is a 
correlation that needs to be made somewhere between the 
username/password and the IP address thats allocated to them. This would 
require some really convoluted coupling between DHCP (which can tell you 
the MAC/IP binding) and customer provisioning systems (which *might* be 
able to tell you the MAC used by a customers cable modem) and the ISP 
firewall, to make sure that a user can only make changes for their own 
IP. This seems pretty complicated to me.

* Its also not clear to me that there aren't security holes in the whole 
thing that might enable someone to learn the passwords and usernames 
needed to control bindings for other IP addresses.

* I dont know whether the MIBs include sufficient ACLs for the above to 
work (have not looked)

IMHO, the topological issues with midcom, which we have long been aware 
of, combined with the CONTROL nature of the relationship between the 
agent and the client, really point to applicability limited to a trusted 
  device that controls a neighboring firewall or NAT, thus useful for 
carrier edge or large enterprise edge applications.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
Chief Technology Officer                    Parsippany, NJ 07054-2711
dynamicsoft
jdrosen@dynamicsoft.com                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
midcom mailing list
midcom@ietf.org
https://www1.ietf.org/mailman/listinfo/midcom