Subject: Re: (radius) WG LAST CALL on L2TP RADIUS Drafts

From: "Harald Alvestrand (outlook)" <[email-masked]>
Date: Thu, 28 Jan 1999 09:10:19 +0100

>> >>Absolutely.
>> >>That is *exactly* what a security section is supposed to be.
>> >>Or rather, for the tunnel-auth draft: The list of questions that each
>> >>mode of operation raises,
>
>I'm not quite clear on what you mean by 'modes of operation'.
>

Since there turns out to be only one mode of operation, namely
tunnels from the dial-in NAS to a tunnelling server, it doesn't make
much sense for me either.

>> >>which each tunnelling protocol has to answer.
>
>Sorry, Harald, but this makes no sense to me: it's like putting the
>security considerations for every unix command into the man page for rsh.
>Realistically, that's just what we're doing here: the RADIUS server is
>telling the NAS to start a tunnel to a certain destination.

And there are security issues with making such a tunnel, and those
security issues have to be documented.
That's all that the hullaballoo has been about so far; haven't you been
listening?

In particular, this is going to be deployed where the NAS belongs to one
organization and the client and the tunnel endpoint belong to another; the
security section HAS to document how much these need to trust each other.

                  Harald

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Glen Zorn <[email-masked]>
Date: Thu, 28 Jan 1999 11:48:04 -0800 (PST)

> That's all that the hullaballoo has been about so far; haven't you been

Carefully, I thought.

> security section HAS to document how much these need to trust each other.

Certainly, but those issues seem to me to be constant regardless of the
type of tunnel created.

-