Subject: RE: [Isms] securityName in Keep the agent simple; was RADIUS is not a trusted third party

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Fri, 29 Apr 2005 12:11:18 -0700

> From:  Wes Hardaker
>
> ... Operators that don't use RADIUS or 
> other centralized AAA architecture won't want to add it just 
> to deploy SNMP.  Similarly, operators that have done away 
> with on-the-device accounts in favor of centralized services 
> won't want to deploy on-the-device accounts.
> 
> That's what makes the problem hard.  It's actually multiple 
> problems that should have the same end requirements in the 
> operators eyes: use what they have, not something else.
> 

So I think the ideal solution should be able to give operators
both choices: local user account and/or centralized AAA users.
I think EUSM, for example, supports both modes.

Khanh

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Ken Hornstein <[email-masked]>
Date: Fri, 29 Apr 2005 15:18:20 -0400

>I think EUSM, for example, supports both modes.

I agree that EUSM supports both of those modes; I'm not sure it supports
everything that people wanted, but that's not really important now.

But in terms of _architecture_ (which is what we're talking about), I
think any of the three architectures _could be made_ to support all of
the security systems that operators have expressed interest in.

--Ken

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 29 Apr 2005 12:20:17 -0700

>>>>> On Fri, 29 Apr 2005 12:11:18 -0700, "Khanh Nguyen (khanhvn)" <[email-masked]> said:

Khanh> So I think the ideal solution should be able to give operators
Khanh> both choices: local user account and/or centralized AAA users.
Khanh> I think EUSM, for example, supports both modes.

Every solution presented to date does (though it's spelled out better
in some than others).

-- 
Wes Hardaker
Sparta, Inc.