Re: [HOKEY] ERX fraud issue

[Alan DeKok <aland@deployingradius.com>]

Bernard Aboba wrote:
> [BA] By a "stream" you mean Accounting-Requests from a single NAS, right?

  Yes and no.  From the point of view of the home server, there is *one*
user login.  This *should* translate into one accounting stream.  Which
NAS(es) generate that stream is a separate issue.

> As the user moves between NASes, Accounting-Requests will be generated,
> with Start/Stop to mark the beginning and end of a session on a particular
> NAS.

  Yes.  These packets go through the visited AAA server, which talks to
the visited ERX server.  That visited AAA server SHOULD be made
responsible for reconciling accounting streams from disparate NASes in
it's local network.

> [BA]  So with ERX it is necessary to do a full EAP authentication every time
> a peer enters a new domain? I guess that this is a consequence of not
> being able to assume EMSK caching within the AAA server.

  That's my interpretation of what was said in Hokey.

>> The accounting stream is tied to the original EAP authentication,
>> which must carry information about the visited domain.
> 
> [BA] How is information about the visited domain encoded by the NAS? 

  It doesn't need to be.  The proxy knows about the visited domain, and
can add that information to the AAA packet stream.  This may require
policy changes on those proxies, and maybe a new AAA attribute.  But it
won't require code changes.

> Looking at the document, it appears that the DSRK can be requested
> by any ERX proxy along the path.

  Yes.  I'm not sure I understand that part.  If the visited domain
implements ERX, it can terminate the ERX requests.  If it doesn't
implement ERX, then it can't proxy those requests.

  i.e. the only thing that makes sense to me is that the ERX proxies (if
any) are all within the visited domain.

>  Does the AAA server assume that
> whatever ERX proxy has submitted the request is valid before delivering
> the key? Or is there information provided by the NAS that it is supposed
> to check against?  For example, does it do a reverse PTR RR query
> on the NAS-IP-Address Attribute and check that the proxy submitting
> the DSRK request is within the same domain?

  Not really sure...

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>