Subject: Re: W-7 CAP Auto-logout Timer

From: [email-masked]
Date: Thu, 19 Aug 1999 11:20:27 -0400

John shot back:
>> The CS wouldnt just drop the connection w/o first sending some form of
>> msg to the CUA
>
>Even if your CS never crashes, you can't be sure of this.  What if I
>suspect someone's abusing a security hole in my CS? I'm not going to
>take the time to say goodbye to each user cleanly; I'm just going to
>kill the process.

If you are an attacker, sure.  If you are an Admin, you wont be that harsh 
w/your users (unless you hate 'em and dont care about your annual 
performace reviews!)  You are more likely to send "Shutting down for 
maintenance" msgs to users than just powering the system off.  (Then again 
I know some folks who may do that anyways.)

Im using the mind set of an authorized admin, not that of an attacker who 
may or may not hack my CS.  That worry is why we have Bob and Paul... ;^)

>I agree that a notification with some human-readable text (maybe written
>by the admin) may be useful; 

Hence my original suggestion...  (Although I think "may be useful" is a 
definite understatement.)

>but the CUA will always need to be able to
>deal with unclean closes.

Never said it wouldn't.  Im suggesting this from the POV of making it 
easier/nicer for CU/CUAs.  If the Admin does a "nice shutdown" (or the CS 
policy times out the idle CUA) then why not make it easy for the CUAs to 
deal w/it??  This isn't rocket science Im proposing; just a simple 
solution to item W-7.

Bruce
===========================================================================
Bruce Kahn                                INet: [email-masked]
Iris Associates                          Phone: 978.392.5335
Westford, MA, USA 01886                    FAX: and nothing but the FAX...
Standard disclaimers apply, even where prohibited by law...

---

From: John Stracke <[email-masked]>
Date: Thu, 19 Aug 1999 12:00:28 -0400

[email-masked] wrote:

> If you are an attacker, sure.  If you are an Admin, you wont be that
> harsh w/your users (unless you hate 'em and dont care about your
> annual performace reviews!)  You are more likely to send "Shutting
> down for maintenance" msgs to users than just powering the system
> off.  (Then again I know some folks who may do that anyways.)
>
> Im using the mind set of an authorized admin, not that of an attacker
> who may or may not hack my CS.

So am I.  If my server is under attack, and I have no quick way of
blocking just the attacker, I will shut down the server gracelessly.  My
users will be irritated, but less so than if the attacker starts
harvesting or corrupting their private data.

(I'm not speaking theoretically here; this happened to me a week or two
ago.)

--
/=============================================================\
|John Stracke    | My opinions are my own | S/MIME & HTML OK  |
[email-masked]|============================================|
|Chief Scientist | NT's lack of reliability is only surpassed |
|eCal Corp.      |  by its lack of scalability. -- John Kirch |
\=============================================================/

---

From: David Madeo <[email-masked]>
Date: Thu, 19 Aug 1999 12:11:36 -0400

> easier/nicer for CU/CUAs.  If the Admin does a "nice shutdown" (or the
> CS policy times out the idle CUA) then why not make it easy for the
> CUAs to deal w/it??  This isn't rocket science Im proposing; just a
> simple solution to item W-7.

I'd agree that the CS should attempt to notify the client as to why it's
dropping the connection.  Don't handshake on it or anything, just send
the message, wait a few seconds, ignoring any incoming data and drop the
connection.

As an end-user, I'd rather see a message saying "Server says: going down
due to water leak" rather than just a dropped connection.

The reason it should be in the spec is so that clients can be coded to
understand the message and possibly pass it on to the customer.  Whether
a given installation, or even a given implementation server chooses to
send a message should be optional.

dmadeo