Subject: [Isms] isms prototyping status

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 25 Apr 2006 15:48:14 +0200

Hi,

this list is pretty silent and hence I though I report a bit about the
current status of our work at IUB to prototype SNMP over SSH.

We now have some running SNMP over SSH code - far from being complete
but good enough to make some measurements in order to figure out what
the overhead is. I believe this is a major concern shared by many
people and I like to provide some concrete numbers soon.

We have basically written an SSH transport mapping for NETSNMP using
libssh (and SSH C library implementation) and right now we kind of run
SNMPv1/SNMPv2c over it (probably not terrible useful, but simple to
get running). We map the SSH user name to the security name and bypass
the community-based security model, basically ignoring the community
name for any authentication purposes.

The SSH transport on the server side currently only supports password
authentication. However, we have hooked password authentication to the
PAM API which allows to use local accounts or RADIUS or LDAP or
... just by appropriate PAM configuration. This is nice.

We started coding the secruity model portion of SSHSM but that might
take some more time to get running since we want to focus on some
measurements first.

My first usage experience of all this is great:

	snmpwalk -v 2c -c ignored ssh:example.org 1.3.6

is all you have to type, if you want to request an explicit user name
you type

	snmpwalk -v 2c -c ignored ssh:[email-masked] 1.3.6

and that is it. Performance concerns me a bit - but we have to
understand more closely where the delays we are seeing are coming from
and whether something can be done about it. Things obviously look much
better once the message sizes increase; getbulk is really your friend
here. The SNMP measurements we are doing in production networks so far
however do not suggest that the actual usage of getbulk out there is
overwhelming - but this is just an early observation; once we have
more traces we will have a clearer picture and perhaps we can then
even report that management applications are actually smarter than
they look right now.

Once we have some more data (in say two weeks since one student
involved in the measurements has a hard deadline ;-), I will post a
more detailed report to the list and make the code available for
general consumption.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Tue, 25 Apr 2006 11:31:36 -0700

>>>>> On Tue, 25 Apr 2006 15:48:14 +0200, Juergen Schoenwaelder <[email-masked]> said:

Juergen> We have basically written an SSH transport mapping for
Juergen> NETSNMP using libssh (and SSH C library implementation) and
Juergen> right now we kind of run SNMPv1/SNMPv2c over it (probably not
Juergen> terrible useful, but simple to get running). We map the SSH
Juergen> user name to the security name and bypass the community-based
Juergen> security model, basically ignoring the community name for any
Juergen> authentication purposes.

<net-snmp-hat>

That's not quite the best way to do things, by the way...  I'd be
happy to provide guidance on the better way to do things that will
actually allow a SNMPv3 packet with a SSH security model to be used
instead...  Functionally that's what I implemented a while back but
over stdin/out instead of using a ssh library.

</net-snmp-hat>
-- 
Wes Hardaker
Sparta, Inc.

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 25 Apr 2006 22:38:34 +0200

> over stdin/out instead of using a ssh library.

I did not say it is the best way to do things - in thing I wrote
"probably not terrible useful, but simple to get running". I am aware
of the "localsm" security model you may be referring to and we are
looking at clone it as a starting point for the security model portion
of the SSHSM. Concrete insights on how this all works from people who
know this code base better than we do are of course always welcome...

/js

https://subversion.eecs.iu-bremen.de/svn/schoenw/src/net-snmp-5.3.0.1/

---

From: "Randy Presuhn" <[email-masked]>
Date: Tue, 25 Apr 2006 14:43:28 -0700

Hi -

> From: "Juergen Schoenwaelder" <[email-masked]>
> To: <[email-masked]>
> Sent: Tuesday, April 25, 2006 6:48 AM
> Subject: [Isms] isms prototyping status
...
> and whether something can be done about it. Things obviously look much
...

Two things that I've seen with some SMUX and AgentX implementations
that might be at work here to negatively impact performance are interactions
with the Nagel algorithm and with TCP slowstart.  Using the NONAGEL ioctl
or its equivalent, if you're not already doing so, might make a difference.

Randy

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 26 Apr 2006 12:31:18 +0200

On Tue, Apr 25, 2006 at 02:43:28PM -0700, Randy Presuhn wrote:
 
> that might be at work here to negatively impact performance are
> interactions with the Nagel algorithm and with TCP slowstart.  Using
> the NONAGEL ioctl or its equivalent, if you're not already doing so,
> might make a difference.

Indeed. After tweaking the sockets a bit this morning, things started
to behave much more reasonable. Now we are getting ready to produce
some numbers...

/js