Subject: RE: [Isms] RE: Radext attributes

From: "Nelson, David" <[email-masked]>
Date: Mon, 31 Oct 2005 10:11:33 -0500

Kaushik Narayan writes...
 
> <Kaushik> I am not sure about the alternative since the user
> authentication (RADIUS Access_Request) needs to happen prior to the
SSH
> session establishment.

Why?  I'm not suggesting that authentication SHOULD occur after SSH
session establishment, I'm merely suggestion that I don't see that it
MUST occur before.  Could you please elaborate?

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Eliot Lear <[email-masked]>
Date: Mon, 31 Oct 2005 16:38:40 +0100

> MUST occur before.  Could you please elaborate?

I think you two are talking about two different "establishment"s.  In 
Kaushik's case he's saying that the SSHSM subsystem has not been started 
and so it can provide no hints to radius *unless* a separate port is in 
use.  (It is possible albeit arguably undesirable to accomplish the same 
task based on specific usernames, but I think we'd all agree that's just 
plain ugly).

Eliot