Subject: Re: [midcom] STUN issue #6: Client certs considered harmful

From: "Panayiotis A. Thermos" <[email-masked]>
Date: Wed, 20 Nov 2002 10:27:48 -0500

I believe the initial inception of STUN was to work similar
to a "ping" request. Adding additional authentication mechanisms
to the client side will add more processing that is intended.

I wouldn't want to authenticate each time I'm "pinging" a host.

If you want to limit who is accessing the STUN service you can
enforce filtering rules in your filtering device (e.g. router/firewall)
or even integrate an IP lookup feature in your STUN server
implementation (similar to TCP wrappers).

Once you start requiring client authentication it means that you have to
maintain a user/password database or a directory with user credentials
(e.g. certificates).

Just a thought.

                    Melinda Shore                                                                    
                    <mshore@cisco        To:     "Christopher A. Martin"                             
                    .com>                <[email-masked]>                             
                                         cc:     "'Jonathan Rosenberg'" <[email-masked]>,   
                    11/19/2002           [email-masked], (bcc: Panayiotis A. Thermos/Telcordia)     
                    01:48 PM             Subject:     Re: [midcom] STUN issue #6: Client certs       
                                         considered harmful                                          

> Unauthorized access/use of the server

Understood, but I think that the word "unauthorized" needs
more explication in this context, or at least we need to
understand what the risk to the server is.  That's
particularly a concern given that the mitigation (client
authentication) introduces a DoS threat, itself.

Melinda
_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: "Christopher A. Martin" <[email-masked]>
Date: Wed, 20 Nov 2002 09:53:44 -0600

I understand. 

It is just my personal opinion that the concept of this type of ping
could be considered a violation of many security policies in place that
could be abused by users behind networks not intended to use it. Then
again, it could be blocked by policies at the security enforcement
point. I don't believe it to be simply a "ping" tool, it provides
information to internal users in order to provide
traversal/circumvention that may not be authorized.

But if this is the intention of STUN then that is fine, as long as I
have presented the concern that I have, everyone can make their own
opinion. This will be my last comment on this topic, I don't want to
waste cycles of everyone here toward the current goals and direction of
MIDCOM.

It has its place, for SOHO and individuals this is perfect, for
enterprise this may not fit. So use the right tool for he right job, eh,
as long as it can be prevented for the enterprise?

Thanks,
Chris

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Panayiotis A. Thermos
Sent: Wednesday, November 20, 2002 9:28 AM
To: Melinda Shore
Cc: Christopher A. Martin; 'Jonathan Rosenberg'; [email-masked]
Subject: Re: [midcom] STUN issue #6: Client certs considered harmful

I believe the initial inception of STUN was to work similar
to a "ping" request. Adding additional authentication mechanisms to the
client side will add more processing that is intended.

If you want to limit who is accessing the STUN service you can enforce
filtering rules in your filtering device (e.g. router/firewall) or even
integrate an IP lookup feature in your STUN server implementation
(similar to TCP wrappers).

Just a thought.

                    Melinda Shore

                                         cc:     "'Jonathan Rosenberg'"
<[email-masked]>,   
                    11/19/2002           [email-masked], (bcc:
Panayiotis A. Thermos/Telcordia)     
                    01:48 PM             Subject:     Re: [midcom] STUN
issue #6: Client certs       
                                         considered harmful

Understood, but I think that the word "unauthorized" needs
more explication in this context, or at least we need to understand what
the risk to the server is.  That's particularly a concern given that the
mitigation (client
authentication) introduces a DoS threat, itself.

Melinda

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 21 Nov 2002 11:22:43 -0500

> traversal/circumvention that may not be authorized.

So, let me understand. You are saying that there may be an enterprise 
that has a NAT. It has a policy which says that "we don't want our users 
using this STUN thing". There is a STUN server outside the network that 
users are trying to contact. The STUN server is not run by the enterprise.

It would appear to me that having the STUN server authenticate the 
client doesn't address this issue in any way whatsoever. Since the STUN 
server and enterprise are different providers, what good is 
authentication. THere is no trust relationship there at all.

If the enterprise wants to block STUN, it could turn off access to port 
3478, the default stun port. This is the same thing an enterprise would 
do to disable HTTP, or POP, or IMAP, or whatever. It has the same issues 
and limitations as for those protocols.

So, please explain to me how authentication has anything to do with this.

-Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

---

From: "Christopher A. Martin" <[email-masked]>
Date: Thu, 21 Nov 2002 11:33:06 -0600

I already stated it could be blocked... and you are right no different
than blocking any other service. 

It was just food for thought, nothing more, if it didn't provide any
further concern to look into this further then no harm done, and as I
said before I have more reading to do, this horse may have already been
beaten to death, if so, my apologies.

Chris

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Jonathan Rosenberg
Sent: Thursday, November 21, 2002 10:23 AM
To: Christopher A. Martin
Cc: 'Panayiotis A. Thermos'; 'Melinda Shore'; [email-masked]
Subject: Re: [midcom] STUN issue #6: Client certs considered harmful

Christopher A. Martin wrote:
> could be considered a violation of many security policies in place 
> that could be abused by users behind networks not intended to use it. 
> Then again, it could be blocked by policies at the security 
> enforcement point. I don't believe it to be simply a "ping" tool, it 
> provides information to internal users in order to provide 

using this STUN thing". There is a STUN server outside the network that 
users are trying to contact. The STUN server is not run by the
enterprise.

So, please explain to me how authentication has anything to do with
this.

-Jonathan R.