<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Alan DeKok wrote:
<blockquote cite="mid20060602151824.7544416E0B@mail.nitros9.org"
type="cite">
<blockquote type="cite">
<pre wrap="">My problem is that there can be hotspots on dynamic ip addresses.
The solution I found actually is to have an unique secret shared with
all hotspots.
So the secret is known by everybody.
</pre>
</blockquote>
<pre wrap=""><!---->
Or, make the hotspots NOT have dynamic IP's. There's no reason why
they should have dynamic IP's.
</pre>
</blockquote>
In my project, I don't own the hotspots, and don't know about the
hotspots ISPs.<br>
The hotspots communicate to the radius server though the internet.<br>
<blockquote cite="mid20060602151824.7544416E0B@mail.nitros9.org"
type="cite">
<pre wrap=""></pre>
<blockquote type="cite">
<pre wrap="">- What can a malicious user can do with the secret? Can it alter
accounting and other things? (chillispot uses chap auth-type)
</pre>
</blockquote>
<pre wrap=""><!---->
If someone knows the secret, he can do *anything* to the packets
without the RADIUS server being able to tell.
</pre>
</blockquote>
Ok. I don't know much about the radius protocol details, maybe you
could help me understanding how secure would be a solution where the
secret is know by everybody.<br>
Chillispot uses CHAP authentication with a different secret per hotspot.<br>
I consider is part as secure.<br>
Now, once a user is authenticated, how does the nas send accounting
info?<br>
Does it have to authenticate again, or is its ip address (and its
(public known)secret) sufficient to authenticate?<br>
Do you need at least a session id?<br>
<br>
Imagine that the malicious use cannot listen to the radius
communications. What can it do without authentication?<br>
<br>
I need security, because I will use accounting info to perform
facturation...<br>
<br>
Thanks for your great help.<br>
<blockquote cite="mid20060602151824.7544416E0B@mail.nitros9.org"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">- Is there a way of maintaining a per hotspot secret with dynamic ip
addresses?
</pre>
</blockquote>
<pre wrap=""><!---->
Not really, no.
</pre>
</blockquote>
this means I must use a vpn client to connect to the radius server?<br>
I would have liked a simple chillispot installation...<br>
<br>
Regards<br>
Sophana KOK<br>
</body>
</html>