Subject: [OPS-AREA] SNMP notification configuration

From: "David Harrington" <[email-masked]>
Date: Wed, 28 May 2008 17:28:39 -0400

Hi,

The ISMS WG could use some operator feedback.

We are developing the ability to use SSH to secure SNMP. Since
operators already use SSH to secure CLI shells and Xwindows and other
things, this is reasonably straightforward for SNMP request-response
traffic.

Question #1:
For SNMP notifications, the SNMP agent will need to act as an SSH
client, and the SNMP notification receivers will need to act as an SSH
server. Will operators find this objectionable?

Question #2:
Would operators prefer to modify their existing user and key
management solutions, such as implementation-dependent CLI scripts, to
configure SSH clients on devices where they may not be found now, or
would operators prefer to have the ISMS WG develop a standard MIB
module to configure and manage the SSH credentials needed to have SNMP
agents act as SSH clients?

David Harrington
[email-masked]
[email-masked]
[email-masked]

_______________________________________________
OPS-AREA mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ops-area

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 29 May 2008 07:38:52 -0700

Comments below. 

> From: [email-masked]
> To: [email-masked]; [email-masked]
> Date: Wed, 28 May 2008 17:28:39 -0400
> Subject: [OPS-DIR] SNMP notification configuration
> 
> Hi,
> 

Assuming that the SNMP notification receivers are hosts running sshd, 
this doesn't seem problematic.  

> agents act as SSH clients?

Personally, it seems a lot easier to deal with scripts than to attempt to configure SSH via MIBs. 
_______________________________________________
OPS-AREA mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ops-area

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 29 May 2008 08:36:05 -0700

>>>>> On Thu, 29 May 2008 07:38:52 -0700, Bernard Aboba <[email-masked]> said:

BA> Personally, it seems a lot easier to deal with scripts than to
BA> attempt to configure SSH via MIBs.

I think David's question was worded a bit oddly...  He wasn't saying it
was the only way to do things, the question is: should there be a way to
do it via MIBs so that a manager could be written to support assisted
configuration or would no one actually use that and want to use personal
scripts anyway (IE, would the effort to write a MIB be wasted and unused).
-- 
Wes Hardaker
Sparta, Inc.
_______________________________________________
OPS-AREA mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ops-area

---

From: Pekka Savola <[email-masked]>
Date: Fri, 30 May 2008 10:34:12 +0300 (EEST)

> server. Will operators find this objectionable?

In our case, routers, switches, etc. are not allowed to log in (ssh 
allow_hosts, firewall rules in various places) to the management 
systems.  As a result this approach would require significant changes 
to ACL policies.

I'm not saying this is a show-stopper, but I suspect many (most?) 
other networks will require similar changes, and depending how easy 
for them it is to enumerate all the possible IP addresses or prefixes 
their SNMP-notifying equipment might use could be a challenge.

> agents act as SSH clients?

I expects scripts to be used.  I would not expect SNMP (write) MIBs to 
be used.  It's possible that a MIB could be used in a read-only mode 
to verify configuration correctness, however.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
_______________________________________________
OPS-AREA mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ops-area

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Fri, 30 May 2008 08:23:11 +0200

> attempt to configure SSH via MIBs.

I would actually agree with Bernard. In addition, we have for years  
been trying to get more vendors to implement SSHv2 public key  
authentication, i.e no user/password login exactly to make it easier  
to script.

Best regards,

- kurtis -