Subject: [Isms] Re: Network management authorization

From: Wes Hardaker <[email-masked]>
Date: Tue, 11 Jan 2005 10:23:47 -0800

>>>>> On Tue, 11 Jan 2005 10:53:28 -0500, "David B Harrington" <[email-masked]> said:

David> That's why I personally would like to see the EUSM proposal, or
David> something similar, be advanced.

I think what you really mean there is you want the final solution to
be able to use Radius (like both SBSM and the TLS one was striving
for, though the details aren't spelled out in either but its in the
goals)).  Or do you mean you want radius to be the only supported
authentication solution, like EUSM requires?

-- 
Wes Hardaker
Sparta

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Tue, 11 Jan 2005 15:09:54 -0500

Hi,

I want a solution that can use RADIUS for authentication, since RADIUS
is widely deployed, and a RADIUS solution could utilize
management-policy-id filters, or something comparable, to map to
SNMPv3 access control mechanisms like VACM. It's not the only solution
I want, but one of the solutions I want.

The SBSM and the TLS proposals can also use RADIUS, but I would like
to avoid solutions that provide yet another layer of indirection
beyond the one provided via the securityModel abstraction. As I worked
on analyzing how a transport layer security model could be implemented
using protocols like TLS, DTLS, and SSH, I found that the available
transport layer solutions seemed to do the same thing - provide a
layer of abstraction to <your favorite security mechanism goes here>,
and nobody actually ever seemed to solve the problem of providing a
concrete solution, they only pass the buck to another protcol.

Yes, different communities segments have different needs, and we
should try to make it possible for those different communities to
solve their needs using different solutions/mechanisms, but ultimately
somebody somewhere somehow needs to make a concrete proposal that will
work, and will be administratively consistent with, and equally secure
as, other concrete security solutions that are actually being
deployed.

I don't want RADIUS to be the only supported solution, since it
obviously doesn't resolve the needs of some segments of the coumminty,
but I would like to see concrete proposals like EUSM that are
consistent with other security solutiions that are being widely
deployed. The TLS security model doesn't meet the "concreteness" goal
since it provides a layer of abstraction to [TLS/DTLS/SSH], which
themselves provide a layer of abstraction to <some other security
protocol>; EUSM comes close to meeting the "concreteness" criteria by
using a solution that seems fairly consistent with the
802.1X/RADIUS/RFC3580 network access solution. (Of course, the fact
that Bernard Aboba claimms EUSM does things with RADIUS that are
forbidden by the RADIUS protocol doesn't help its case a lot.)

When the TLS securitymodle, or the SBSM securitymodel, has a concrete
backend specified in a way that can actually be implemented, then I'll
think we're making real progress. 

dbh

> -----Original Message-----
> From: Wes Hardaker [mailto:[email-masked]] 
> Sent: Tuesday, January 11, 2005 1:24 PM
> To: [email-masked]
> Cc: 'Martin Soukup'; [email-masked]
> Subject: Re: Network management authorization
>

---

From: Kaushik Narayan <[email-masked]>
Date: Tue, 11 Jan 2005 13:29:45 -0800

Hi David,

We are not aware of any violations with the basic functionality of RADIUS/EAP
as described in RFC3579 except for key caching which is new functionality.

regards,
   kaushik!

---

From: "David B Harrington" <[email-masked]>
Date: Tue, 11 Jan 2005 16:41:52 -0500

I don't recall what Barnard's objections were; you should check with
him.

dbh 

> From: Kaushik Narayan [mailto:[email-masked]] 
> Sent: Tuesday, January 11, 2005 4:30 PM
> To: [email-masked]
> Cc: 'Wes Hardaker'; [email-masked]
> Subject: Re: [Isms] RE: Network management authorization
> 
> Hi David,
> 
> > > David> That's why I personally would like to see the EUSM 
> proposal,
> >or