Subject: Re: (radius) WG LAST CALL on L2TP RADIUS Drafts

From: "Glen Zorn" <[email-masked]>
Date: Fri, 15 Jan 1999 13:49:01 -0800

Harald Tveit Alvestrand <[email-masked]> writes:

>I'll reiterate what I told Glen in private mail:
>
>A worry has been expressed to me that this set of drafts describe how to
>set up a tunnel between a corporate firewall and a NAS box.

That's an accurate representation, I think.

>This would make the NAS box part of the trust boundary of the corporation,
>and expose the NAS box operator to heavy liability and operational
problems.

One thing that I don't understand is why that is an IETF (protocol, not
political ;-) problem.  There are many service providers willing to accept
those risks and responsibilities, and many that are rolling out that type of
service now.

>
>Some possible responses:
>
>- The protocol does not require the endpoints of a tunnel to be in any
>  particular place. The tunnel endpoint could be at the connected system,
>  where it ought to be.
>
>  Counter: How would the NAS box tell the connected system to set up a
>           tunnel, if there is no such function in its connection protocol?
>           Anyway, if that's a recommended mode, it should be documented.
>
>- Tunnels aren't just for security. There might be other reasons to tunnel.
>
>  Counter: But if you use tunnels for security, you should be warned that
>           you can't use this feature.

That's not necessarily true: if you rely upon the NAS to start e.g. an IPSec
tunnel for you _and_ do not prpvide any other protection for your sensitive
traffic (TLS, Kerberos, PGP, etc.), then there is the risk that the fabled
"evil ISP" would sniff your traffic and cause horrible things to happen
(note that this is true in _any_ security gateway <==> security gateway
scenario).  OTOH, both L2TP and PPTP allow the PPP client to negotiate
directly with the tunnel server, so the client can insist upon PPP
encryption.

>
>I certainly don't understand this protocol well enough to see what's
possible,
>what's reasonable and what's obvious.
>
>But I know that I didn't feel like I understood the problem and the Right
>Way to solve it after reading the documents.
>
>And that I don't like.
>
>                         Harald A
>
>--
>Harald Tveit Alvestrand, Maxware, Norway
>[email-masked]
>
>-
>To unsubscribe, email [email-masked]' with
>'unsubscribe ietf-radius' in the body of the message.
>

---

From: "Mike O'Dell" <[email-masked]>
Date: Fri, 15 Jan 1999 16:53:26 -0500

it is patently irresponsible to promulgate a protocol feature
which is known to have *catastrophic* security implications

	-mo

-