Subject: RE: [Isms] Network management authorization

From: "David T. Perkins" <[email-masked]>
Date: Tue, 11 Jan 2005 16:20:43 -0800 (PST)

HI,

DBH - I think "misquote" is a little too strong!

The facts are the following:
1) SBSM can use radius (and all other authentication
   mechanisms that Wes and I have looked at).
2) SBSM is an umbrella approach based on light weight
   sessions, which can be used over a UDP or TCP transport.
   (NOTE: a session does not imply use of TCP.)
3) SBSM sessions have better security properties than
   USM
4) Authorization is out of scope of the ISMS WG. However,
   there are several approaches that can be supported
   by SBSM to make deployment and ongoing use of SNMP
   easier. The most obvious is to not use table
   vacmSecurityToGroupTable, and instead get the
   group using the mechanism used for authentication
   (such as from a Radius server).

Regards,
/david t. perkins

On Tue, 11 Jan 2005, David B Harrington wrote:

> Hi Wes,
> 
> Sorry to irk you.
> 
> I was responding largely to david's misquotes of what I had said, and
> to his claim that "On the other hand, SBSM could use the 
> ...radius-management-authorization... proposal pretty easily."
> 
> I searched the SBSM proposal to see how it supported RADIUS and could
> utilize the RADIUS-specific management-policy-id attribute, but didn't
> see how it would do so pretty easily. I see now that I misread the
> Goals and Objectives section - I missed the "... met by this protocol
> include" sentence, much as you missed Eric's "ascending importance"
> sentence, so it wasn't clear that a workable solution for RADIUS had
> been found. The SBSM proposal does not describe how it can support
> RADIUS at this point, so I had difficulty understanding how it would
> use the RADIUS management-policy-ID proposal pretty easily. 
> 
> I apologize for my confusion.
> 
> dbh
>  
> > -----Original Message-----
> > From: Wes Hardaker [mailto:[email-masked]] 
> > Sent: Tuesday, January 11, 2005 5:57 PM
> > To: [email-masked]
> > Cc: 'David T. Perkins'; 'Martin Soukup'; [email-masked]
> > Subject: Re: [Isms] Network management authorization
> > 
> > >>>>> On Tue, 11 Jan 2005 17:42:20 -0500, "David B 
> > Harrington" <[email-masked]> said:
> > 
> > David> The other proposals could use use RADIUS and a
> > David> management-policy-id attribute as well, but neither discusses
> > David> doing so. SBSM says working with RADIUS is a goal, but also
> > David> seems to conclude that working with RADIUS simply won't work
> -
> > David> "Several approahces were considered, but none were determined
> > David> workable."
> > 
> > Ok, I've been too busy to respond to the rest of the comments today.
> > But this one just irked me since you tied two totally different
> > sections together by pulling a sentence from a later unrelated
> section
> > and some how applied it to the authentication section.
> Specifically,
> > you're pulling text from the history section, in particular from
> > David's recanting of his past history about thinking about the
> > problem.  In particular, in that section he was describing how he
> > thought about tying something directly to Radius but in the end
> didn't
> > think it would be usable.
> > 
> > In short, SBSM as is (without modification) can be tied to radius
> now.
> > The authentication systems in the back aren't complete for various
> > reasons, as the draft states and as I stated previously this week,
> but
> > the local authentication mechanism that is defined there today
> passes
> > the information needed to the agent for the agent to do a radius
> > exchange.  This exchange could, but doesn't have to, lead to
> > bootstrapping of the VACM via similar mechanisms as the other drafts
> > discuss.  It's not mentioned within the SBSM document directly
> because
> > it's out of scope of the working group, but maybe I should have put
> a
> > note in saying that it in no way impedes progress in any VACM
> > centralization scheme.
> > 
> > -- 
> > Wes Hardaker
> > Sparta
> > 
> 
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Randy Presuhn" <[email-masked]>
Date: Tue, 11 Jan 2005 17:40:16 -0800

Hi -

> From: "David T. Perkins" <[email-masked]>
> To: "David B Harrington" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Tuesday, January 11, 2005 4:20 PM
> Subject: RE: [Isms] Network management authorization
...
>    mechanisms that Wes and I have looked at).

It would have helped if it had actually spelled out the details
of how this would work for one of these mechanisms, rather
than just asserting it.

...
>    (such as from a Radius server).
...

It may be out of scope, but I think failing to address this issue
would be a big mistake.  If no mechanism (like the one
suggested) is provided, the the "integration" won't work until
the security administrator uses SNMPv3 to configure the
vacmSecurityToGroupTable, either manually or using something
like the dead MIASMA proposal.

Randy

---

From: "David T. Perkins" <[email-masked]>
Date: Wed, 12 Jan 2005 13:27:37 -0800 (PST)

HI,

We can talk about changes that make the SNMPv3 authorization
system easier to deploy and keep operational. Wes and I have
chatted much about this. However, it's out of scope, and it
really seemed to us that it was a separable and mostly
independent work with the SBSM approach.

Maybe at the next IETF we could have a BOF to talk about
authorization issues, and present some solutions. 

On Tue, 11 Jan 2005, Randy Presuhn wrote:
<stuff cut>
Regards,
/david t. perkins