[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: RE : [midcom] More on new work item
Joel Tran wrote:
There is a serious trust issue here. Is the ISP really going to issue a
username and password to every user of their network, entrusting them
with permissions to use midcom to manage port bindings on their network
wide NAT?? I certainly hope not. Thats an open invitation for
substantial denial of service attacks.
-Jonathan R.
Correct me if I'm wrong. I don't think it is an open invitation for DOS attack
if there is a proper Access Control List/Policy Rule in the Midcom device which
may limit the use of the port bindings for each user.
I don't think this can work easily.
How would the ACL be structured? Presumably, you'd want to say something
like, "user joe is allowed to open up pinholes directed to his currently
allocated IP address". There are several major problems here:
* if there is any other NAT intervening the user and the ISP's nat (very
common here in the US at least, due to residential NAT devices like
those made by linksys), this of course won't help even if you work out
the ACL issues
* assuming no other nats between the user and the ISP NAT, there is a
correlation that needs to be made somewhere between the
username/password and the IP address thats allocated to them. This would
require some really convoluted coupling between DHCP (which can tell you
the MAC/IP binding) and customer provisioning systems (which *might* be
able to tell you the MAC used by a customers cable modem) and the ISP
firewall, to make sure that a user can only make changes for their own
IP. This seems pretty complicated to me.
* Its also not clear to me that there aren't security holes in the whole
thing that might enable someone to learn the passwords and usernames
needed to control bindings for other IP addresses.
* I dont know whether the MIBs include sufficient ACLs for the above to
work (have not looked)
IMHO, the topological issues with midcom, which we have long been aware
of, combined with the CONTROL nature of the relationship between the
agent and the client, really point to applicability limited to a trusted
device that controls a neighboring firewall or NAT, thus useful for
carrier edge or large enterprise edge applications.
-Jonathan R.
--
Jonathan D. Rosenberg, Ph.D. 600 Lanidex Plaza
Chief Technology Officer Parsippany, NJ 07054-2711
dynamicsoft
jdrosen@dynamicsoft.com FAX: (973) 952-5050
http://www.jdrosen.net PHONE: (973) 952-5000
http://www.dynamicsoft.com
_______________________________________________
midcom mailing list
midcom@ietf.org
https://www1.ietf.org/mailman/listinfo/midcom