Subject: RE: [Isms] Discussion: Architecture direction for ISMS

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 14 Apr 2005 18:55:48 -0400

> I think the disconnection here is that the SNMP people keep stating
> that no existing engine has any credentials, and that Sam (and
> possibly others) is saying that SNMP with an ISMS solution in place
> will result in SNMP engines with credentials possibly associated with
> it in the future. 

I see. Makes sense. Though in that case it would've been better to
explicitly state that despite speaking in present tense and seemingly
about the existing setup (that can be used for our purposes), it applies
only to possible future.

> EG, if SSH is used then the SSH Host Key will
> likely be a credential for future SNMP engines that are configured to
> allow for an SNMP/SSH transport and at *that* point an engine will
> functionally have a credential.

I see. Yes it can work. Does it imply that the SSH Host key will be
shared between SSH daemon and SNMP engine? And the host identity this
key is bound to, will be shared by all the SNMP engines that may run on
that host? Or will each of them generate its own PK pair?
-- 
Wes Hardaker
Sparta, Inc.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 15 Apr 2005 13:32:19 -0700

>>>>> On Thu, 14 Apr 2005 18:55:48 -0400, "Blumenthal, Uri" <[email-masked]> said:

Wes> EG, if SSH is used then the SSH Host Key will
Wes> likely be a credential for future SNMP engines that are configured to
Wes> allow for an SNMP/SSH transport and at *that* point an engine will
Wes> functionally have a credential.

Uri> I see. Yes it can work. Does it imply that the SSH Host key will
Uri> be shared between SSH daemon and SNMP engine?

I think that's somewhat implementation dependent.  I see advantages of
having the SSH server and a SNMP agent running over SSH sharing the
same key, but I don't see problems with them using different keys as
well and I could see administrators *wanting* separate keys.  From a
protocol point of view, it seems more like a deployment and
implementation problem than something which we should tackle
directly.  If I had to pick one, I'd pick a shared key because it
would be reusing existing infrastructure more and thus I think would
make more operators happy today.  From a security perspective,
however, I don't see the need to rule out the use of separate keys if
someone wanted to configure their systems that way.

-- 
Wes Hardaker
Sparta, Inc.