Subject: Re: [Isms] ISMS Operational Scenario/Goal

From: Wes Hardaker <[email-masked]>
Date: Wed, 02 Mar 2005 12:48:37 -0800

>>>>> On Mon, 28 Feb 2005 17:05:48 -0500, "Nelson, David" <[email-masked]> said:

>> To use SNMPv3/ISMS, the information that is needed is
>> ONLY the IP address of the system to be managed, a user
>> identity, proof of the user identity, and verifier or
>> the identity of the managed system. An examples of this
>> last part include the SSH fingerprint, or the CA cert
>> of the managed system's cert. There SHOULD NEVER be
>> a requirement that there be an IP address and/or key
>> for a Radius server. They are not needed now for management
>> via SSH or via a WEB browser.

David> I think this is an {unfortunate | undesirable | mistaken}
David> requirement.  I specifically object to the notion that "the SSH
David> fingerprint, or the CA cert of the managed system's cert" are
David> acceptable configuration prerequisites but "the IP address
David> and/or key for a Radius server" are not acceptable.  That
David> distinction "cooks the books" in terms of eliminating potential
David> solutions from consideration. If you want to use just about any
David> commercially deployed AAA client-server system, then the AAA
David> clients will need to share pre-configured credentials with the
David> AAA server.

You have a choice:

1) require the user to install and configure security infrastructure
   they're currently not using, such as an AAA server they weren't
   previously using, or an AAA server with new extensions that aren't
   needed for anything but SNMP.

2) don't.

David's argument (one I agree with) is merely that if you do #1 you
aren't achieving the original goals set forth in the charter.  IE, to
reuse existing infrastructures.  If you require them to do something,
that's simply not reusing.  I suspect that a good number of people in
this community, however, feel that #1 is acceptable as long as the
cost of doing so is low.  My argument is that nobody wants to do SNMP.
They do it because they have to.  Putting anything in the way of them
being able to merely means they'll want to use it even less.  SNMP is
a side technology that is only useful because other technologies exist
and need to be managed.  This isn't a negativism toward SNMP at all,
it's merely a fact.  SNMP exists because other things need to be
managed.  It would be useless by itself.  And as such, users would
rather everything never need management but they know this is
impossible.  If #2 was doable above, then they'd have to do a lot less
to make use of the protocol that might help them manage their other
technologies and thus you'll get quicker and greater adoption.

David never said, nor will he ever if I know him well at all, that an
AAA shouldn't ever be used as a possible source of authentication
information for SNMP.  He said it shouldn't be required, and it
shouldn't be required to _modify_ it in order to make SNMP
authentication happen.

-- 
Wes Hardaker
Sparta

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Kaushik Narayan <[email-masked]>
Date: Wed, 02 Mar 2005 14:13:18 -0800

We have tried to follow the advice of the Evaluation Team by
adding to the EUSM spec further details of how to use PKI and
Kerberos for EUSM.  By doing so, it should become clear to all
that EUSM doesn't require the use of AAA.

In the case where operators desire integration with AAA,
we believe it is better to have that SNMP piggy-back on changes
already needed/being developed for AAA for other protocols
(e.g., 802.11), rather than developing a new SNMP-specific
security protocol.

regards,
  kaushik!