Subject: Re: (radius) Tagged attribute question (fwd)

From: MegaZone <[email-masked]>
Date: Wed, 14 Apr 1999 12:24:51 -0700 (PDT)

Once upon a time Glen Zorn shaped the electrons to say...
>This seems to be reasonable.  Are people treating the Tag field the same in
>Tunnel-Password as in integer attributes (i.e., it disappears)?  If so, then
>this obviously doesn't work.  BTW, I thought that his remarks dealt _only_

What I've seen seems to indicate yes.  But for that matter it looks like
those using it today are sending it as a plain old string - not doing any
of the MD5 work.  Has any NAS vendor implemented Tunnel-Password as in the
draft, and NOT as a plain string?

I'm concerned about this - if deployed systems use it as a plain string this
could cause trouble when/if vendors try to use the draft system.

-MZ
-- 
<URL:mailto:[email-masked]> Gweep, Discordian, Author, Engineer, me..
Join ISP/C Internet Service Providers' Consortium <URL:http://www.ispc.org/>
"A little nonsense now and then, is relished by the wisest men" 781-788-0130
<URL:http://www.megazone.org/>  <URL:http://www.gweep.net/>  Hail Discordia!
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Matt Holdrege <[email-masked]>
Date: Wed, 14 Apr 1999 12:32:22 -0700

>draft, and NOT as a plain string?

Ascend encrypts it. Our customers do not want this password flying around
unencrypted. It could be used for a nasty DoS attack.

-

---

From: Ignacio Goyret <[email-masked]>
Date: Wed, 14 Apr 1999 12:57:37 -0700

>could cause trouble when/if vendors try to use the draft system.

I don't know what vendors you are talking about but Ascend has implemented
the draft (including the MD5 stuff) for a long time. We considered for a little
while allowing plain text passwords as well but then decided against it.
Both NavisRadius and the free RADIUS server posted in Ascend's ftp server
support encrypted Tunnel-Passwords.

-Ignacio

-