Re: When to Access-Reject vs. Silently Discard

[Bernard Aboba <aboba@internaut.com>]

>   The only times I can see (NAS-IP-Address != source IP) for local
> NASes are buggy implementations, or security breaches.  Is there
> another case that text is trying to address, that I'm missing?

That's about it.

>   If it's a buggy implementation, upgrade.  If it's a security breach,
> an Access-Reject is wrong: the NAS should be de-listed from the known
> clients, to avoid an attacker using the trust relationship to gain
> knowledge about users.

Certainly the NAS should be delisted, but presumably that will not occur
automatically, but as the result of administrator action responding to an
appropriate alert.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>