Subject: RE: [Isms] Network management authorization

From: "Nelson, David" <[email-masked]>
Date: Wed, 12 Jan 2005 12:58:33 -0500

Wes Hardaker writes...

> Randy> Although that is modeled in VACM, it can also be considered
> Randy> part of user management.  Failing to address it would be a
> Randy> grave mistake for the WG, IMO.
> 
> I think it should be a goal too.  But, I don't think it should be tied
> to the authentication system since that would then require that the
> authentication system be tied to radius, which I don't think would
> make every operator out there happy.  Not everyone uses radius (and in
> fact my survey showed this clearly).  If we only supported a radius
> based extension we would not even be supporting a majority of the
> market, which seems very counter to exactly what we're trying to do.

OK.  Use the generic term AAA instead of a specific protocol name, e.g.
RADIUS.  It is very important, however, that the authorization (e.g.
group name) be strictly tied to the authentication and be provided as
part and parcel of the AAA service.  Not doing so give rise to potential
security weaknesses.

-- Dave

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 12 Jan 2005 10:54:03 -0800

>>>>> On Wed, 12 Jan 2005 12:58:33 -0500, "Nelson, David" <[email-masked]> said:

David> OK.  Use the generic term AAA instead of a specific protocol
David> name, e.g.  RADIUS.  It is very important, however, that the
David> authorization (e.g.  group name) be strictly tied to the
David> authentication and be provided as part and parcel of the AAA
David> service.  Not doing so give rise to potential security
David> weaknesses.

My point is, David, that not everyone wants to use a centralized
service like AAA.  In fact, the majority of the people out there *are
not*.  Thus, providing a solution via this working group that mandates
the use of a AAA server is simply not going to make operators happy.

What I want:

Manager < -------------- > Agent < ---------------> AAA
              ISMS                     maybe
                                       VACM-ties

Thus, *if* a agent is authenticating a manager through an AAA server
on the back side, then it would be absolutely nice *if* the
administrator ed wanted to distributing grouping or other
authorization information within the AAA transaction used to
authenticate the manager's ISMS request.  However, there is no reason
to force-tie the ISMS protocol security to the VACM-tie-in service.
This should be done as policy/configuration on the agent, not by
forcing it on users that don't want it.  I very much agree that it
would be useful for those operators that have AAA servers, and would
love to see the work done.  But I violently oppose it dictating that
the only way the ISMS half of the solution can be done is by use of a
AAA server.  That simply does not meet the needs of the people out
there and such results would be short sighted in the eyes of the
operators.  If, however, a nice marriage was possible (and it should
be) then operators would have added incentive to switch to a AAA
architecture to get the bonus benefits, which will make the AAA
vendors happy (buy our product and suddenly your SNMP configuration
burdens are eased).  But please don't force that on the operators that
already have an existing infrastructure that doesn't require an AAA
server and may not want to maintain one.

-- 
Wes Hardaker
Sparta

---

From: "David B Harrington" <[email-masked]>
Date: Wed, 12 Jan 2005 14:20:46 -0500

Hi,

I think Dave's point was, and I will reiterate it myself:
"It is very important that the authorization be strictly tied to the
authentication"

This is a point that was discussed at length in the development of
SMIv2/v3.
Failure to strictly tie these together is a security problem.
(Like I should have to tell you!)

dbh

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Wes Hardaker
> Sent: Wednesday, January 12, 2005 1:54 PM
> To: Nelson, David
> Cc: [email-masked]
> Subject: Re: [Isms] Network management authorization
>