Johan Meiring wrote:
I realise, i've asked for the before, and it is on your todo list, but I'd like to make a case again for maybe getting it moved up higher onto the list.
My "to do" list right now is: - consulting work (my *only* source of income is FreeRADIUS) - 3 IETF documents that I'm author / co-author - White paper for a linux conference
The current "clients" structure identify the NAS's by ip address. While this is perfect for corporate environments, it is not so perfect for the hotspot environment in which we operate.
RADIUS was never designed to work that way. It's insecure. One of the documents I'm writing involves leveraging SSL to allow that capability. But implementations are a long ways out.
We need to somehow authenticate the nas, so someone can not send "rough" accounting info to radius.
You could always write a simple RADIUS proxy that did those checks. It likely could be done in ~200-300 lines of Perl.
I'm sure that I'm not the only one that have NAS's behind dynamic IPs, and this would make radius traffic from such NAS's much more secure.
Maybe... Alan DeKok.