Why KAME/racoon sucks (was: OpenSWAN ANNOUCEMENT)

[Michael K. Johnson]

On Sun, Jan 04, 2004 at 09:36:45AM +0200, Pekka Savola wrote:
> On Sat, 3 Jan 2004, Dax Kelson wrote:
> > g) XAUTH support (authenticate VPN users/tunnels via PAM)
> 
> This is dangerous, and has been rejected in the IETF for 
> standardization.  Why again should this be done then?  If you want to 
> authenticate users/tunnels via PAM, can't this be done by creating a 
> PAM module interfacing IKE?

It's really required for a lot of setups, and it's one of the key
features that makes me feel that it is probably worth the trouble
if OpenSWAN 2.x is ready in time.

You aren't REQUIRED to use it, but for people who aren't in a
position to dictate to their network peers what protocols to
use, the ability to do XAUTH is still valuable.  Sure, warn
people about the potential attacks, but not everyone is in a
position to dictate whether or not they will use XAUTH.

And it doesn't really matter, frankly, that it was rejected
as an internet standard; it's a de-facto standard right now
and making it possible for people to use it is not going to
hurt Fedora or Linux...

My opinion, anyway.

michaelkjohnson

 "He that composes himself is wiser than he that composes a book."
 Linux Application Development                     -- Ben Franklin
 http://people.redhat.com/johnsonm/lad/