Subject: Re: (radius) WG LAST CALL on L2TP RADIUS Drafts

From: "Glen Zorn" <[email-masked]>
Date: Fri, 15 Jan 1999 14:42:04 -0800

Harald Tveit Alvestrand <[email-masked]> writes:

>At 13:52 15.01.99 -0500, Beadles, Mark A. wrote:
>>
>>If the NAS box operator is not willing to accept this liability and
>>operational
>>issues, then the NAS box operator should not offer this type of service.
>>That
>>is a business question, not a protocol question.
>>
>>On the other hand, there are service providers who are willing to accept
the
>>liability and operational issues, and customers who are willing to accept
>>the
>>redrawing of trust boundaries in order to receive the functionality
desired.
>>
>>We cannot let protocols dictate business models.  We must make our
protocols
>>flexible enough to accommodate any reasonable business model.
>
>Agreed. I care about quality of documentation and "fair warning", not about
>saving the world from itself.
>
>IF (the security section of?) this draft set discusses the diverse models
>for deployment and the dangers they incur to the point where I can see at
>once what I had to have pointed out to me, I have no real problem with
>shipping it; sort of "This is a gun. That is your foot. If you put your
>finger here and pull, your foot will not be terribly useful."

Wow!  A well-reasoned, intelligent argument.

>
>Or to use another metaphor: I don't want to lower the temperature of
>McDonald's coffee (it's bad enough as it is), I want to make sure people
>know it's hot.
>
>If possible.

I think it's possible.  I will revise the security considerations section of
the attributes draft again to point out these concerns.  Are there any
others?

>
>                  Harald A
>
>--
>Harald Tveit Alvestrand, Maxware, Norway
>[email-masked]
>
>-
>To unsubscribe, email [email-masked]' with
>'unsubscribe ietf-radius' in the body of the message.
>

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Sat, 16 Jan 1999 02:19:36 +0100

>the attributes draft again to point out these concerns.  Are there any

I certainly hope it's possible.
I think you need a couple of subsections:

- Deployment scenarios (where a tunnel can go, and how it gets there)
  
- Threats that are appropriate to different scenarios

- Available or needed protection mechanisms for each scenario

I'd think that it would be best to post candidate text to the list
before going to the bother of shipping a new draft; it's often easier
to get people to read smaller pieces of text.

Once you, I and the list believe we have something, I'll certainly ping
our security ADs to see what they think about it before shipping
it off to the Last Call.

I'm sure there can be other concerns - I'd like to find a reviewer
for it who has *somewhat* more RADIUS knowledge than I have, but isn't
actively involved in it, to do a review & evaluation;
any volunteers?

Looking forward to going forward....I'm changing the status of the
-auth draft on my tracking page to "New version expected", and the
2 others to "waiting for -auth".
(see http://www.ops.ietf.org)

                 Harald A

-