Re: Radius & Logoff (fwd)

MegaZone (megazone@livingston.com)
Thu, 6 Jun 1996 14:15:48 -0700 (PDT)

Once upon a time ywliu shaped the electrons to say...
>Of course we cannot prevent a user from logging out. But I think about a
>possibile situation that : I connect to the server and then fake a logout
>message to the RADIUS server. Then what happens ? I can still be on-line

So they fake an MD5 signature? With or without knowing your shared secret?

You have some seriously skilled users.

>service. Also, I think that's why TACACS and ERPC treat logout as antoher
>auth request.

Again - I can't talk much about TACACS, but we must have a disconnect where
ERPCD is concerned. It doesn't do any user authentication on logout.

-MZ

--
Livingston Enterprises - Chair, Department of Interstitial Affairs
Phone: 800-458-9966 510-426-0770 FAX: 510-426-8951 megazone@livingston.com
For support requests: support@livingston.com  <http://www.livingston.com/> 
Snail mail: 6920 Koll Center Parkway  #220, Pleasanton, CA 94566