Re: [radext] Fwd: RE: Fwd: RE: Fwd: RE: Mail reguarding draft-ietf-radext-dynamic-discovery

Hi,

>   I'm not sure.  Maybe I'm missing something.  If a proxy is about to
> send radsec traffic for realm A to IP address B, can't it do a DNS
> lookup on IP address B to see if realm A is listed?

Well, if realmA (or anyone for that matter) wants to DoS proxy B, then
it can also see which realms B actually serves (say, "therealrealm"),
and publish an article stating "free net access for username@therealrealm".

B would have an IP reverse with the indication that it *is* serving that
realm - and the TLS connection would come up. The reverse IP check
doesn't help with that.

Besides that, I also don't like that an IP's reverse DNS lookup which is
intended to provide a *host*name would now be re-used in the different
semantics of providing a *realm*name.

>> For a next rev of dynamicdiscovery, I've added the following paragraph
>> for Security Considerations in my working copy:
>>
>>    With Dynamic Discovery being enabled for a RADIUS Server, and
>>    depending on the deployment scenario, the server may need to open up
>>    its target IP address and port for the entire internet, because
>>    arbitrary clients may discover it as a target for their
>>    authentication requests.  If such clients are not part of the roaming
>>    consortium, the RADIUS/TLS connection setup phase will fail (which is
>>    intended) but the computational cost for the connection attempt is
>>    significant.  With the port for a TLS-based service open, the RADIUS
>>    server shares all the typical attack vectors for services based on
>>    TLS (such as HTTPS, SMTPS, ...).  Deployments of RADIUS/TLS with
>>    Dynamic Discovery should consider these attack vectors and take
>>    appropriate counter-measures (e.g. blacklisting known-bad IPs on a
>>    firewall, rate-limiting new connection attempts, etc.).
>>
>> Is that okay for you?
> 
>   Yes.

Okay, will be in -08.

Greetings,

Stefan Winter

> 
>   Alan DeKok.
> _______________________________________________
> radext mailing list
> radext@ietf.org
> https://www.ietf.org/mailman/listinfo/radext
> 

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

Re: [radext] Fwd: RE: Fwd: RE: Fwd: RE: Mail reguarding draft-ietf-radext-dynamic-discovery

Attachment: signature.asc