Subject: (radius) tunnel-password language

From: Barney Wolff <[email-masked]>
Date: Mon, 13 Dec 1999 12:08 EST

How about:

Tunnel-Password is exposed to the NAS and any RADIUS proxies between
the server and the NAS.  Therefore it SHOULD be ephemeral or unique
to the pair of tunnel endpoints, unless the server has great trust
in the NAS and every proxy.

Barney Wolff  <[email-masked]>
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "David Mitton" <[email-masked]>
Date: Tue, 14 Dec 1999 09:32:54 -0500

>'unsubscribe ietf-radius' in the body of the message.

This is good.

I would also like to see added something before this statement to the 
effect of:

Use of this attribute could have serious security implications.  Please 
read the section below on "Security Considerations".

That section already has spelled out the basic issues.

Dave.
---------------------------------------------------------------
David Mitton                                  ESN: 248-4570
Consulting Engineer, Nortel Networks           978-288-4570 Direct
Carrier Packet Solutions, Preside              978-288-3030 FAX
Billerica, MA 01821                     [email-masked]

-