Subject: Re: [Isms] Discussion: Architecture direction for ISMS

From: Sam Hartman <[email-masked]>
Date: Thu, 14 Apr 2005 16:50:39 -0400

>>>>> "Blumenthal," == Blumenthal, Uri <[email-masked]> writes:

    >> No, I'm arguing an SNMP engine will know what credentials *it*
    >> *has*, not *its users have*.  I.E. an SNMP engine will know
    >> what key it shares with a RADIUS server...

    Blumenthal,> An SNMP engine has *NO* credentials of its own,
    Blumenthal,> period. Never had. All the access is done on behalf
    Blumenthal,> of *users* by other engines.

I believe this is true for managers.  As I said, I believe the problem
is either vulnerable to man-in-the-middle or intractable if this is
true for agents.

However your description does not align well with my understand nor
what I'm hearing from others.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 14 Apr 2005 16:35:27 -0400

> No, I'm arguing an SNMP engine will know what credentials *it* *has*,
> not *its users have*.  I.E. an SNMP engine will know what key it
> shares with a RADIUS server...

An SNMP engine has *NO* credentials of its own, period. Never had. All
the access is done on behalf of *users* by other engines.

Yes it would make cryptography easier if engines had some credentials
(i.e. was associated with some ID that possessed long-term keys, etc).
But it would introduce an *additional* burden of provisioning the SNMP
engines, and mapping *their* identities onto existing infrastructure
(RADIUS database? SSH? /etc/password?).

> I do not think the problem before us can be solved without either
> allowing for man-in-the-middle attacks or requiring that an SNMP
> engine have some credential. Either solution seems to allow sessions
> be established for informs.

:-)

---

From: "Randy Presuhn" <[email-masked]>
Date: Thu, 14 Apr 2005 14:49:36 -0700

Hi -

> From: "Sam Hartman" <[email-masked]>
> To: "Blumenthal, Uri" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Thursday, April 14, 2005 1:50 PM
> Subject: Re: [Isms] Discussion: Architecture direction for ISMS
...
> what I'm hearing from others.
...

Uri's description is correct.  If someone could identify the text in RFC 3411-
3415 that is leading people to believe that SNMP engines have credentials
of their own, we could write an erratum.

(Slightly off topic: the lack of credentials for the engine per se leads to the
extra complexity in the handling of reports.  One may view this as a bug or
a feature, but that's the way it is.)

Randy

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 14 Apr 2005 15:33:12 -0700

>>>>> On Thu, 14 Apr 2005 14:49:36 -0700, "Randy Presuhn" <[email-masked]> said:

Randy> Uri's description is correct.  If someone could identify the
Randy> text in RFC 3411- 3415 that is leading people to believe that
Randy> SNMP engines have credentials of their own, we could write an
Randy> erratum.

Randy> (Slightly off topic: the lack of credentials for the engine per
Randy> se leads to the extra complexity in the handling of reports.
Randy> One may view this as a bug or a feature, but that's the way it
Randy> is.)

I think the disconnection here is that the SNMP people keep stating
that no existing engine has any credentials, and that Sam (and
possibly others) is saying that SNMP with an ISMS solution in place
will result in SNMP engines with credentials possibly associated with
it in the future.  EG, if SSH is used then the SSH Host Key will
likely be a credential for future SNMP engines that are configured to
allow for an SNMP/SSH transport and at *that* point an engine will
functionally have a credential.

-- 
Wes Hardaker
Sparta, Inc.

---

From: Thierry Moreau <[email-masked]>
Date: Thu, 14 Apr 2005 20:13:37 -0400

> (RADIUS database? SSH? /etc/password?).

You would hope that once the SNMP engine gets its initial credentials 
(e.g. a symmetric key, or a private key certified by a PKI certificate) 
  and a link to existing infrastructure, the individual SNMP user 
authentication will be automated. Hence reduced burden, hence isms goal 
reached.

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]