Subject: RE: [Isms] Discussion: Architecture direction for ISMS

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 14 Apr 2005 20:02:38 -0400

>> An SNMP engine has *NO* credentials of its own, period. Never had.
All
>> the access is done on behalf of *users* by other engines.
>> 
>> Yes it would make cryptography easier if engines had some credentials
>> (i.e. was associated with some ID that possessed long-term keys,
etc).
>> But it would introduce an *additional* burden of provisioning the
SNMP
>> engines, and mapping *their* identities onto existing infrastructure
>> (RADIUS database? SSH? /etc/password?).
>
> You would hope that once the SNMP engine gets its initial credentials 
> (e.g. a symmetric key, or a private key certified by a PKI
certificate) 
> and a link to existing infrastructure, the individual SNMP user 
> authentication will be automated. Hence reduced burden, hence isms
goal 
> reached.

Yes, but not so fast! :-)

RADIUS server or whatever is authorizing the user, must provide (besides
the keying, of course) the mapping to SNMP VACM, so that the actual
access control can be performed.

We must solve the first problem first - getting users RADIUS-authorized
(for example). But we must also realize that it is only a half of the
issue. 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Thierry Moreau <[email-masked]>
Date: Thu, 14 Apr 2005 20:42:55 -0400

> (for example). But we must also realize that it is only a half of the

If user mapping to VACM can be in a centralized database accessible to 
the RADIUS server, perhaps we solve half of the other half of the issue!

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]