Subject: (radius) Radius client passwd change

From: Indranil Bagchi <[email-masked]>
Date: Mon, 14 Dec 1998 11:26:44 -0800

Is there a way (a radius attribute) by which a radius client can request the
radius server to
change its passwd. Or does this feature need to be implemented as a
vendor-specific
attribute.

Thanks

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Nelson, David" <[email-masked]>
Date: Mon, 14 Dec 1998 14:54:27 -0500

Indranil Bagchi writes...

> Is there a way (a radius attribute) by which a radius client can
> request the radius server to change its passwd.
> 
No.

> Or does this feature need to be implemented as a vendor-specific
> attribute.
> 
One could contemplate doing that.  The RADIUS WG had a long
debate on password change.  You may wish to search the archives.
The consensus reached was that password change was outside the
scope of RADIUS, and that the security mechanisms needed to do
this "correctly" were possibly incompatible with the RADIUS model.

Having said that, one vendor (Digital, now Cabletron) has implemented
a password change feature in its RADIUS Server product.  This feature
is implementation specific to the RADIUS server code, and does not use
a vendor-specific attribute.

While there is some obvious utility in this feature, you are not going to
find a standardized way to implement it, and you should be aware of the
potential security risks of doing this in a "simplistic" fashion.  Caveat
emptor.

Regards,

Dave

David B. Nelson                          Cabletron Systems, Inc.
Software Engineer V                      50 Minuteman Road
(978) 684-1330                           Andover, MA 01810

-