Subject: [Isms] sbsm and noAuthNoPriv

From: Robert Story <[email-masked]>
Date: Thu, 21 Oct 2004 14:35:53 -0400

While perusing the v3 specs, I ran across this section of RFC 3411:

A.1.2.  Security Processing

   Received messages MUST be validated by a Model of the Security
   Subsystem.  Validation includes authentication and privacy processing
   if needed, but it is explicitly allowed to send messages which do not
   require authentication or privacy.

I know that SBSM explicitly rejects noAuthNoPriv. It would seem to be a
conflict with the rfc, even if there isn't a MUST in there.

Admittedly, if you are using noAuthNoPriv, there is no benefit to even using a
session.

-- 
Robert Story; NET-SNMP Junkie
<irc://irc.freenode.net/#net-snmp>   <http://www.net-snmp.org/>

You are lost in a twisty maze of little standards, all different. 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David T. Perkins" <[email-masked]>
Date: Thu, 21 Oct 2004 12:34:03 -0700 (PDT)

HI,

Back when we were defining SNMPv3, I really wanted to have a
security model, pick the name, like "void". You would use it
for noauth/nopriv. It would also be used in a report when you
didn't support the security model specified in a request.
People thought it would complicate things (since it would
require possibly additional VACM entries).

A noauth/nopriv in all security models essentially maps
to the "void" security model. (And yes, we can debate
my claim.)

> Admittedly, if you are using noAuthNoPriv, there is no benefit to even using a

Regards,
/david t. perkins

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 21 Oct 2004 13:53:40 -0700

>>>>> On Thu, 21 Oct 2004 14:35:53 -0400, Robert Story <[email-masked]> said:

Robert> Received messages MUST be validated by a Model of the Security
Robert> Subsystem.  Validation includes authentication and privacy processing
Robert> if needed, but it is explicitly allowed to send messages which do not
Robert> require authentication or privacy.

Robert> I know that SBSM explicitly rejects noAuthNoPriv. It would seem to be a
Robert> conflict with the rfc, even if there isn't a MUST in there.

Ok.  Easy enough.  Just like encryption can be turned off in the flags
but turned on in the packet, I'll just do the same with authentication
;-)  All messages are authenticated even when you don't ask for it!  Ha!

-- 
Wes Hardaker
Sparta