Subject: DISMAN MIBs and SNMPv3 and VACM

From: "Bert Wijnen" <[email-masked]>
Date: Thu, 17 Dec 98 23:31:51 CET

Speaking as one of your ADs.

It is one thing to start discussions about preceived problems with
SNMPv3 security and/or VACM restrictions that make your life as
a DISMAN MIB designer more difficult. And discussing that can of
course help us all to try and find better solutions.

However.... maybe some of that should be done in "research groups"
as opposed to standardization groups. This can go on in parallel
with the standardization efforts.

Why don't we live with the SNMPv3 and VACM for now and try to work
with it. The DISMAN group has a track record of complaining
about SNMPvx not being ready or having requirements on SNMPvx etc.
The result is that the WG exists now for what 3-4 years and yet
we have to deliver the first Proposed Standard.

And delivering a Proposed Standard is just the beginning.
After that, we want to see people to ship products based on these
MIBs and then we want to see deployment of this.

If one thing was clear to me from our NEWSNMP BOF, then it was that
the real users don't want us to keep fiddling with design and bits
and bytes. They want producst that star to deploy our SNMP protocols
and MIBs.

Bert

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 18 Dec 1998 00:54:32 +0100

>>>>> Bert Wijnen writes:

Bert> Why don't we live with the SNMPv3 and VACM for now and try to
Bert> work with it.

This is exactly what we are trying to do. It turns out that working
with SNMPv3 and VACM caused us to invent some new ideas in order to
make a secure scripting MIB possible. And I hope we are pretty close
to Proposed Standard with a secure scripting and scheduling MIB based
on SNMPv3 and VACM.

Sure, we have reported to other working groups that responsible for
the infrastructure we use where improvements would make our live
easier. This is basically the securityName in multiple groups issue
reported to SNMPv3 and the isAccessAllowed support requested from
AgentX. We did not get the critical mass together in both the SNMPv3
and the AgentX WG to make any changes soon and we did accept that. In
any case, reporting requirements or "wishes" back to other WGs is
actually a part of a fruitful process and I do not see what is wrong
with it.

Bert> The DISMAN group has a track record of complaining about SNMPvx
Bert> not being ready or having requirements on SNMPvx etc.  The
Bert> result is that the WG exists now for what 3-4 years and yet we
Bert> have to deliver the first Proposed Standard.

This statement is not really fair. You know very well that SNMPv3 was
approved as a Proposed Standard just about a year ago. And I am pretty
sure that a scripting MIB would have never passed the IESG without
addressing the security issues involved. We now deliver a solution
which also describes in quite some detail how you configure SNMPv3's
VACM to ensure that you have proper protections of scripts owned by
different entities or users. And we also explain how you have to use
the SNMPv3 isAccessAllowed() ASI when processing operations on the
Script MIB. Yes, the DISMAN WG is active for a long time (and we
really had a slow start due to other reasons such as disappearing
chairs and a lack of man power due to the SNMPv3 work), but I think we
are doing pretty well with regard to some of our deliverables.

Bert> And delivering a Proposed Standard is just the beginning.  After
Bert> that, we want to see people to ship products based on these MIBs
Bert> and then we want to see deployment of this.

We have already two independent implementations of the Script MIB even
though we are not yet Proposed Standard. This is at least encouraging.

							Juergen
-- 
Juergen Schoenwaelder  [email-masked] http://www.cs.tu-bs.de/~schoenw
Technical University Braunschweig, Dept. Operating Systems & Computer Networks
Bueltenweg 74/75, 38106 Braunschweig, Germany.        (Tel. +49 531 / 391 3289)