Subject: (radius) Re: Shared secrets

From: Barry L James <[email-masked]>
Date: Thu, 24 Feb 2000 10:50:36 -0700 (MST)

(my mail system bounced these messages last night, so...)

Hi Brian,

> 1) Are shared secrets allowed to be updated dynamically, or
> is it required to restart both client and server for the change to take
> effect?

I believe this is implementation dependent and the RADIUS protocol doesn't
speak to it.

> 3) Must a shared secret be consistent within a call or can it change
> between, say, an
> Accounting-Start and Accounting-Stop packet?

Since the spec doesn't require that the secret last throughout the entire
session (as opposed to req/res transactional pairs) I don't think there
would be a problem with the accounting portion.  It might be alittle
trickier for the access piece as you may need to keep the previous secret
for any pending access-requests that may be queued up to be processed.

> Non-shared secret questions
> 4) If a connection is lost to the RADIUS server and then later
> re-established,
> is there an Accounting-On packet required?

The RFC doesn't state that an Accounting-On ever has to be sent, but most
NAS gear I've worked with only send Accounting-On's at bootup.

Regards,
Barry

> Thanks in advance,
> Brian Czako

Barry L James            | Never doubt that a small group of
IP SWAT                  | thoughtful, committed citizens can
Level 3 Communications   | change the world.  Indeed, it's 
http://www.level3.com    | the only thing that ever has.
Member IEEE, AAAI        | #include <std_disclaimer>

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.