Re: [radext] Fwd: RE: Fwd: RE: Fwd: RE: Mail reguarding draft-ietf-radext-dynamic-discovery

[Alan DeKok <[e-mail]>]

Sam Hartman wrote:
> We cannot be planning to have security of RADIUS over TLS devolve to an
> IP ACL check.

  It won't.  Maybe I'm missing something.

  I just want to ensure that we have a *simple* way to check if an IP
address can accept requests for a realm.  If the answer is "no", then
TLS shouldn't start.  If the answer is "yes", then TLS starts, with all
of the security mandated by TLS.

  i.e. It's a low-cost additional check before TLS.  I never proposed it
*replace* TLS.

  I'm worried about administrators mis-configuring realms.  "Hey,
company X says that server Y is a RADIUS proxy.  We'll list it for our
realm Z!"

  And then all of the traffic for these idiots goes to server Y.  No one
figures out this is wrong until after the TLS handshake.  Which can give
a DoS attack on server Y.

  A *simple* double-check can help prevent this.  The proxies get told
to go to server Y.  So they ask it.  "Do you handle realm Z"?  When the
answer is "no", they know to go bug realm Z to fix their business
relationships.  They DON'T bug server Y with useless requests.

  Alan DeKok.