Nod, but you then appear to be keying that to port numbers which is insecure
so you are saying 'change the kernel to do XYZ' when doing XYZ doesn't help.
> > and verification at the boundary points too. In that case the boundary
> > points can generate IP-AH frames with MD5 signatures based on authentication
> > data provided.
>
> Can you please elaborate this point. This will be really very useful.
> I will appreciate it.
If the machine your mobile agent connects to was extended to support one
of the authentication protocols for IP frames. IP-AH is an IP extension
that ends frames with
[IP-HEADER][IP-AH header][MD5 data][Packet]
so you can have the mobile host talk to the FA which then sends packets
that are signed and include user auth info. In fact you could probably
skip MD5 and hide the data in other ways providing you strip it at thee
firewall itself. IP-AH has an RFC. (IP authentication header)
Alan
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu