Subject: (radius) Security question about Radius

From: ßN·¬ <[email-masked]>
Date: Mon, 22 Nov 1999 15:25:32 +0800

Hello,

Because the request message from NAS to the Radius server
were not authenticated, the hacker might crash the server by
sending many request, right?
Can we do something to protect the server?

Hsiao-Feng

---

From: "David Mitton" <[email-masked]>
Date: Mon, 22 Nov 1999 09:33:26 -0500

An authentication server should be written in a robust and defensive manner.

There should be no message that causes it to crash.
Flooding it with many messages, should simply cause messages in excess of a 
queue length or processing capability of the server to be discarded.
This would be a potential Denial-Of-Service (DOS) attack, to which RADIUS 
is no more vulnerable than any other TCP/IP protocol.

RADIUS doesn't require that you process messages from any given sender.
Most implementations will not process a message from a system which is not 
configured in it's known clients file, with a shared secret.

         Dave.

>Can we do something to protect the server?

---------------------------------------------------------------
David Mitton                                  ESN: 248-4570
Consulting Engineer, Nortel Networks           978-288-4570 Direct
Carrier Packet Solutions                       978-288-3030 FAX
Billerica, MA 01821                     [email-masked]
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.