Subject: Re: [Isms] RADIUS is not a trusted third party (fwd)

From: "David T. Perkins" <[email-masked]>
Date: Fri, 15 Apr 2005 12:23:44 -0700 (PDT)

HI,

This didn't seem to go through....

regards,
/david t. perkins

---------- Forwarded message ----------
Date: Fri, 15 Apr 2005 10:48:09 -0700 (PDT)
From: David T. Perkins <[email-masked]>
To: Sam Hartman <[email-masked]>
Cc: Martin Soukup <[email-masked]>, [email-masked]
Subject: Re: [Isms] RADIUS is not a trusted third party

HI,

Got to agree with this from Sam, and especially the part
that the "command generator" wil not know which mechanism
(such as Radius) is being used. In the presentation at
the ISMS meeting, this is shown in slide 11
(http://www3.ietf.org/proceedings/05mar/slides/isms-2/sld11.htm)
which shows that when a session is established, the
command responder (called the SNMP agent in the slide),
uses a local policy setting to determine which of potentially
several mechanisms to use for authentication of the
command generator (called the SNMP manager in the slide).

On Fri, 15 Apr 2005, Sam Hartman wrote:

> >>>>> "Martin" == Martin Soukup <[email-masked]> writes:
> 
>     Martin> RADIUS "Access-Accept" indicates a successful
>     Martin> authenthentication response for a user.
> 
>     Martin> The Access-Accept already returns a "Session-Timeout",
>     Martin> defined as "Sets the maximum number of seconds of service
>     Martin> to be provided to the user before the session
>     Martin> terminates. This attribute value becomes the per-user
>     Martin> "absolute timeout."".
> 
> This only tells the SNMP engine talking to the RADIUS server the
> timeout.  You need to tell the other side of the exchange the timeout
> too.
> 
> Remember that RADIUS is a callout service; it is not a trusted third
> party.  In other words, in a particular SNMP authentication, only one
> of the parties will know that RADIUS is being used.
> 
Regards,
/david t. perkins

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms