Subject: RE: [Isms] Network management authorization

From: "Nelson, David" <[email-masked]>
Date: Wed, 12 Jan 2005 14:09:04 -0500

Wes Hardaker writes...
 
> My point is, David, that not everyone wants to use a centralized
> service like AAA.  In fact, the majority of the people out there *are
> not*.  Thus, providing a solution via this working group that mandates
> the use of a AAA server is simply not going to make operators happy.

A local username and password database is a degenerate instance of AAA.
AAA does not imply "remote" or "centralized", although that is certainly
the most common case.

My point is that authentication provides evidence of identity.  It does
not, in the general case, provide evidence of "access rights" to
management interfaces, *especially* in a centralized AAA (single
sign-on) deployment.  In the local database AAA deployment, it may be
that the existence of a credential implies access rights.  That's fine.
While I never suggested mandating remote AAA as the only model, I do
feel that *when* remote AAA is used it is important that at least the
first two "A"s in Authentication, Authorization, and Accounting be
considered.

I also think that the kinds of "scaling" issues that folks complain of
in static password or static key based SNMPv3 deployments will drive
folks to want to use centralized AAA.  The fact that surveys show little
usage of centralized AAA for SNMP access control may be (at least
partly) explained by the fact that there are not currently any
standardized linkages, of the kind we are discussing.  The
non-availability of a feature in products often shows up as lack of
fielded deployments of that particular feature.  Right?  :-)

-- Dave

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 12 Jan 2005 12:37:23 -0800

>>>>> On Wed, 12 Jan 2005 14:09:04 -0500, "Nelson, David" <[email-masked]> said:

David> I also think that the kinds of "scaling" issues that folks complain of
David> in static password or static key based SNMPv3 deployments will drive
David> folks to want to use centralized AAA.

FYI, I agree with this.  It's highly likely that it would be a more
optimal choice much of the time.  It's certainly more efficient than
rdisting local account/authorization information to a zillion machines.

David> The fact that surveys show little usage of centralized AAA for
David> SNMP access control may be (at least partly) explained by the
David> fact that there are not currently any standardized linkages, of
David> the kind we are discussing.

There is no AAA service for SNMP.  The survey was asking generically
what they used for any authentication mechanism.  IE, the reality was
that local accounts were used for most remote logins via telnet or
ssh.  It had nothing to do with SNMP.  And it's these existing
credentials that they want to tie SNMP too if possible to make it more
usable for them.  A good Radius salesman may convince them of a better
way to do things, but I'm not a salesman nor will I ever play one in
life or on TV.

David> The non-availability of a feature in products often shows up as
David> lack of fielded deployments of that particular feature.  Right?

If your guess is right, the answer should have been 0 (since it
doesn't exist, it couldn't be used).  However, the question was about
authentication in general.

-- 
Wes Hardaker
Sparta