Subject: [Isms] open issues

From: "David B Harrington" <[email-masked]>
Date: Mon, 31 Mar 2008 14:00:09 -0400

Hi,

Juergen has asked for some status on open issues.
The open issues list in the secshell doc is still accurate.

#2 could be resolved by allowing an operator to preconfigure a MIB
like usmUserTable to provide the mapping from various
mechanism-specific identities to securityName. Such preconfiguration
could use the identity function to set secruityName if no mapping is
provided. Or, they could preconfigure in an implementation-dependent
manner. Without preconfiguration, and using a default identity
function, an operator would need a VACM entry for each
mechanism-specific identity.

#3 (same as #2; opposite direction. Not sure if there are any
additional complications in this direction.

#5 and #8 can be resolved by having securityModel in tmStateRef
override message processing selection of model. But we would need to
discuss security considerations for doing so, and check whether there
are any unforeseen implications (much as doing it the current way had
implications with RFC3584). If we do this, then #2 and #3
preconfiguration might become specific to each transport mapping, or
share a common table.

#6 is about whether the access controls applied are for the same
authenticated identity (client vs server) as in USM. I think this
needs further research of who must be authenticated for each operation
type, and whether the security rules about which identity must be
authenticated when using an operation are consistent with SSH and USM
and the architecture.

David Harrington
[email-masked]
[email-masked]
[email-masked]

> -----Original Message-----
> From: Juergen Schoenwaelder 
> [mailto:[email-masked]] 
> Sent: Thursday, March 27, 2008 5:29 PM
> To: Dave Harrington
> Subject: isms open issues call
> 
> David,
> 
> what about a skype/phone call next Monday afternoon your time zone
> (evening my time zone)? Something around 9pm would work for me,
which
> should be 3pm your time zone. Later is fine with me as well.
> 
> /js
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
> Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms