Subject: Re: [Isms] Network management authorization

From: Wes Hardaker <[email-masked]>
Date: Wed, 12 Jan 2005 12:18:28 -0800

>>>>> On Wed, 12 Jan 2005 15:07:51 -0500, "David B Harrington" <[email-masked]> said:

David> I think you are reading too much into the term AAA. I consider
David> AAA to be an abstract set of provided services, not specific
David> protocols or particular types of implementation/deployments.

I'm quite possibly doing that, but I'd argue it's largely in part to
how it's being used.  If your definition of AAA also includes the
USM/VACM pair, then I think we're likely much closer in agreement
about what we think is necessary as far as a binding goes.

David> The point Dave and I are making is that there needs to be a binding
David> between the authentication and authorization.

I don't think anyone has said otherwise actually.

David> I will make the point that having such a binding is a matter of
David> being compliant to the SNMpv3 architecture.

Agreed.  You can't be a compliant security model if you somehow trump
the ability for VACM (or some other ACM) to work as an authorization
mechanism.

David> If the authentication and authorization swervices are not in
David> the same engine (SNMP engine or RADIUS server, etc.) then we
David> need to explain HOW they will be appropriately bound in our
David> proposals.

I agree with that completely.  Which means we are probably on the same
page and have been ranting about the same thing in different ways.
Fortunately, I don't think any of the 3 proposals to date were
planning on violating this.  The only one that didn't discuss the
issue at all was yours, actually, but that was merely due to time
constraints not that it wasn't planned.

-- 
Wes Hardaker
Sparta

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Wed, 12 Jan 2005 15:41:41 -0500

> -----Original Message-----
> From: Wes Hardaker [mailto:[email-masked]] 
Here's a good segue I'll take advantage of.

In my view (and not neceesarily in Juergen's), I think it might be
worthwhile to separate the message authentication from the user
identity autentication. 

That is, allow TLS ir IPSec or other lower layer security mechanism to
provide message sendser authentication, integrity checking,
confidentiality, etc., to transport the SNMP request securely.  In
this way, the lower layer security might be host-to-host
authentication, using existing protocols for that purpose; the lower
layer might set up a secure association between message sender and
message receiver. 

Then pass the payload to the SNMP engine, which authenticates the user
identity in the payload, and that authenticated user identity will be
used for authorization purposes. This could be
application-session-based if desired, to minimize overhead, and could
use centralized services, to reduce administration costs.

This approach would eliminate the requirement of passing the
securityname from the tranbsport layer into the application layer,
maintaining a better layer separation.

This separation of transport security from application security could
simplify some aspects of SNMPv3. Such a proposal would require a good
look at the necessary bindings between the different security systems.

David Harrington
[email-masked]

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 13 Jan 2005 00:38:32 +0100

> use centralized services, to reduce administration costs.

I have learned recently on this list that you have to cryptographically 
tie these things together to prevent man-in-the-middle attacks.
 
> look at the necessary bindings between the different security systems.

I guess passing the securityName up will be simpler than the binding
but I am happy to be proven wrong.

/js

[BTW, nice discussions after ten years of work an SNMP security. ;-]

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 12 Jan 2005 15:46:13 -0800

>>>>> On Thu, 13 Jan 2005 00:38:32 +0100, Juergen Schoenwaelder <[email-masked]> said:

Juergen> [BTW, nice discussions after ten years of work an SNMP security. ;-]

The question is: will it matter?  We're having a huge discussion, the
results of which may not matter if the evaluation team proclaims
a totally different approach.

-- 
Wes Hardaker
Sparta

---

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 12 Jan 2005 18:49:05 -0800

Hi -

> From: "Wes Hardaker" <[email-masked]>
> To: "David B Harrington" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Wednesday, January 12, 2005 3:46 PM
> Subject: Re: [Isms] Network management authorization
...
> a totally different approach.
...

Huh?  The WG is perfectly free to ignore the evaluation team's
recommendations.  RFC2418 (section 6.5) is abundantly clear
on this point.

Randy