On Thu, 6 Jun 1996, ywliu wrote:
> >
> > Once upon a time ywliu shaped the electrons to say...
> > >While I was hacking the RADIUS daemons (1.16 or Merit 2.23) to meet our
> > >customized needs, I found that , unlike TACACS or ERPCD, RADIUS doesn't seem
> > >to support user logout authentication, i.e. when a user logs out from the
> >
> > Why in the blue blazes would you want ot authenticate on logout?
> >
> > "Hey, is that you Bob? It'd better be your or I'm not going to let you
> > logout!"
> >
>
> Of course we cannot prevent a user from logging out. But I think about a
> possibile situation that : I connect to the server and then fake a logout
> message to the RADIUS server. Then what happens ? I can still be on-line
> and the the program handling user billing, using the accounting logs generated
> by RADIUS , thinks I am off-line. So, chances are the users can get cheaper
> service. Also, I think that's why TACACS and ERPC treat logout as antoher
> auth request.
>
> Am I worried too much ?
>
> Yen-Wei Liu
>
>
\\\|///
\\ - - //
( @ @ )
+------------------------------oOOo-(_)-oOOo--------------------+
| Victor Muslin | |
| Prodigy Services Company | Voice: (914) 448-4737 |
| 445 Hamilton Avenue, H11A | Fax: (914) 448-8462 |
| White Plains, NY 10601 | Internet: vmuslin@prodigy.com |
+-----------------------------+--------Oooo---------------------+
oooO ( )
( ) ) /
\ ( (_/
\_)