<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On 22 Nov 2011, at 17:32, Dale Grice wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi all,<div><br></div><div><br></div><div>I am hoping that someone can verify my understanding of one part of the Xauth process. I am using a Juniper SSG as a firewall and need to allow access from a vendor on the untrust zone to a server on a demil zone for admin purposes.</div>
<div><br></div><div>My understanding is that freeradius uses the secret password in the clients.conf file to encrypt the user password sent to the Juniper in this case, which then sends to the untrust user for verification. Is this correct. I am trying to determine if the password is in the clear on the Internet or if I have to go through the trouble of setting up a VPN between the vendor and the server.</div></blockquote><div><br></div><div>It's as good as in the clear. Don't send RADIUS packets with User-Password attributes over the public net with the standard RADIUS reversible encryption defined in RFC 2865. It's based on MD5, and MD5 has been horribly broken for years.</div><div><br></div><div>If you want to do this you should download version 3 head, and use the RADSEC functionality, with two RADIUS servers, one acting as a translator for the Juniper between RADSEC and UDP based RADIUS. Or like you say, use a VPN.</div></div><br><div apple-content-edited="true">
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Arran Cudbard-Bell<br><a href="mailto:a.cudbardb@freeradius.org">a.cudbardb@freeradius.org</a><br><br>Betelwiki, Betelwiki, Betelwiki....<span class="Apple-converted-space"> </span>http://wiki.freeradius.org/ !</div></span></div></span></span>
</div>
<br></body></html>