[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Review of Management Authorization -00 document
Hmmm. The NAS-Prompt Service-Type works for all of: local console
connections, telnet, rlogin, ssh, (and more) remote connections. The only
thing we are trying to specify here is whether the remote terminal service
is being carried over a secure transport. Do we really care what the
application layer protocol is?
In current usage, is it possible to send a Server-Type=NAS-Prompt attribute
to a NAS
without a serial port?
As I recall, NAS-Prompt originally did not specify any "application layer
protocol"
at all. Wasn't the purpose to allow an admin connecting to a terminal
server to
administer it over a serial connection?
Assuming that, I'm puzzled as to what it means to specify
Server-Type=NAS-Prompt
along with an underlying framed transport, like TLS. With the RFC 2865
definition
of the NAS-Prompt service, when I hook a terminal emulator to a console
port, or
dialin to a terminal server on a port, I'm going to get an unframed serial
stream of bits
suitable for viewing on a terminal emulator.
Once I specify a Transport Protocol for NAS-Prompt, (say TLS) what am I
going to get?
First off, this is a serial link, so I'd assume that if there is IP flowing
over the link that
we need framing of some kind, either SLIP or PPP. That seems intrinsically
at odds
with a Service-Type=NAS-Port.
So I guess I don't understand the idea of running the NAS-Port or
administrative service
over a Transport Protocol. If we are talking about a framed management
service, then
Servce-Type = Framed-Management seems like it makes more sense.
I think that what we care about is whether it over a secure or non-secure
transport.
Does NAS-Prompt as defined in RFC 2865 have a transport? I thought it was
just
a non-frmaed serial stream of bits.
This feature relies on the authorization module of the NAS being aware of
the transport layer being used by the remote terminal connection, and
ensuring that it matches the provisioned parameters.
When Service-Type=NAS-Prompt, there is no transport layer to be aware of
right?
--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>