Subject: Re: [netmod] RADIUS enhancement to ietf-system

From: Martin Bjorklund <[email-masked]>
Date: Fri, 21 Dec 2012 11:03:33 +0100 (CET)

Hi,

"Lange, Jeffrey K (GE Energy)" <[email-masked]> wrote:
> I've realized that there is a rather critical configuration component missing
> from the RADIUS configuration section of the ietf-system model.  There is no
> way to specify the authentication type to use for a server (PAP/CHAP/EAP
> etc...)
> 
> I have added the following to the model, and I'm passing it along in hopes that
> it can make it into the official model.
> 
> I have included the types PAP,CHAP, and EAP-MD5.  There are a plethora other
> types, as well, but I think these are probably the most common.  This is why I
> created it as an identity as opposed to an enumeration.
> 
> I guess there are a few general questions
> 
> 1)      Should this be included in the standard model (I clearly think yes)

Yes, I think needs to be done.

> 2) Should more types be defined (MS-CHAP / MS-CHAPv2 / SIP Digest / LEAP /
> Cisco LEAP / etc...), this gets tricky for things like EAP-TLS where you also
> need to configure keying material.

We got a comment from Alan DeKok regarding EAP, and he pointed to the
IANA registry for EAP types
(http://www.iana.org/assignments/eap-numbers/eap-numbers.xml)

There are a bunch of them, and as you say some might require more
paramaters, so I feel the best way to handle this now is to add the
authentication-type leaf and the base identity, and leave the handling
of EAP etc to future models.  But we should add the pap and chap
identities, since these are defined in the base RFC (2865).

So I suggest we add:

  identity radius-authentication-type {
    description
      "Base identity for RADIUS authentiation types.";
  }

  identity radius-pap {
    base radius-authentication-type;
    ...
  }

  identity radius-chap {
    base radius-authentication-type;
    ...
  }

and

        leaf authentication-type {
          type identityref {
            base radius-authentication-type;
          }
          default radius-pap;
          description
            "The authentication type requested from the RADIUS
             server.";
        }

> 3) Should each identity be wrapped in a feature that determines whether or not
> the device supports that particular Auth type? Or should the server validate
> the settings at runtime?

I think features for all identities in general are overkill.  

/martin