Subject: Re: [Isms] Network management authorization

From: Wes Hardaker <[email-masked]>
Date: Wed, 12 Jan 2005 11:35:31 -0800

>>>>> On Wed, 12 Jan 2005 14:20:46 -0500, "David B Harrington" <[email-masked]> said:

David> Failure to strictly tie these together is a security problem.

I don't disagree with that.  I disagree with the mandatory tying.  You
MUST have authorization to do something.  That authorization MUST be
tied to an identity which has been authenticated.  You don't
necessarily need to, however, tie it via AAA.  VACM already has a tie,
albeit limited in functionality.  It's the forced binding of two
technologies that I object to.  I'd imagine local policy directives
that would tie authentication systems to a authorization system.  "If
coming in over SNMPv3/XXXX then look up grouping or other information
in authorization system YYYY".  It's the "the solution will use
XXXX/YYYY" that I object to and think doesn't serve the community.

-- 
Wes Hardaker
Sparta

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Wed, 12 Jan 2005 15:07:51 -0500

Hi Wes,

I think you are reading too much into the term AAA. I consider AAA to
be an abstract set of provided services, not specific protocols or
particular types of implementation/deployments.

The point Dave and I are making is that there needs to be a binding
between the authentication and authorization. I will make the point
that having such a binding is a matter of being compliant to the
SNMpv3 architecture. That is not to say that both authentication and
authorization need to be provided by the same service, as is the case
with RADIUS, but that there needs to be a secure binding between the
services that provide these two steps. USM provides the authentication
service in SNMPv3, and VACM provides the authorization; they are
securely bound by being in the same engine, and using the required
securityname as the binding. 

If the authentication and authorization swervices are not in the same
engine (SNMP engine or RADIUS server, etc.) then we need to explain
HOW they will be appropriately bound in our proposals.

dbh

> -----Original Message-----
> From: Wes Hardaker [mailto:[email-masked]] 
> Sent: Wednesday, January 12, 2005 2:36 PM
> To: [email-masked]
> Cc: 'Nelson, David'; [email-masked]
> Subject: Re: [Isms] Network management authorization
>