Subject: Re: [Isms] Why SNMPv3? [WG Review: Integrated Security Model for SNMP (isms)]

From: Wes Hardaker <[email-masked]>
Date: Wed, 22 Sep 2004 22:23:14 -0700

>>>>> On Thu, 23 Sep 2004 07:51:24 +0300 (EEST), Pekka Savola <[email-masked]> said:

Pekka> .. then the justification for SNMPv3's increased security
Pekka> features would indeed be higher.  But few folks do SNMP writes,
Pekka> and many don't bother providing SNMP access to untrusted
Pekka> parties, so the features may not be all that interesting.

You fall right into one category of users, I agree.  Your situation is
likely even common.  However, its not the only case.  If you look at
the proceeding slides from the last ISMS BOF you'll see that the
variation in who is using SNMP, what versions they're using, how
they're using it and what they want from it don't boil down to a
single case.

-- 
Wes Hardaker
Sparta

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Pekka Savola <[email-masked]>
Date: Thu, 23 Sep 2004 07:51:24 +0300 (EEST)

Thanks for the explicit note.

On Wed, 22 Sep 2004, David B Harrington wrote:
> As Wes point sout, SNMPv3 provides security enhancements, but I think
> we need to be more specific. 
> 
> 1) SNMPv3 provides an application-level authentication of the security
> principal. 
[...]
> 2) SNMPv3 USM provides robust authentication of a security principal.
[...]
> 3) SNMPv3 provides access control over the principal's data-level
> authorization
[...]

So, in short, the security features (different kinds) set SNMPv3 apart 
from SNMPv1/2.

Then I'll have to say that SNMPv3 does not seem all that interesting
to many operators, but I'll totally agree that some indeed absolutely
want these features.

Let's consider our particular case (a national research network).  I
guess it should be quite common.

 1) we only use SNMP for read-only access.
 2) we only use SNMP to the routers from (about) two network 
management hosts within our own network.
 2.b) there is one external host from a network monitoring 
organization, using separate [direct] connectivity, which has the same 
RO privileges
 3) we restrict the access to the SNMP port [in all the routers] to 
the IP addresses of the network management.
 4) we eliminate IP spoofing of the network management host addresses
(actually all the addresses, but that's beside the point) at the edge.

To sum it up, as we use SNMP only for RO, the hosts are well-defined,
and the borders are secure, we don't need any encryption or strong
authentication.  Community 'public' is good enough.  Further, we also
don't require providing different views to the different users (two
our own, 1 external) -- that would be more trouble than its worth.

It should seem obvious to me why a lot of folks still stick to
SNMPv1/2, and will continue to do so.

On the other hand, if we wanted to do something like:
 - SNMP writes (e.g., config updates, etc.)
 - provide the customers access to certain parts of the MIB tree of 
their (C)PE router [though some of this is already part of SNMPv2 I 
recall]
 - [etc.]

.. then the justification for SNMPv3's increased security features
would indeed be higher.  But few folks do SNMP writes, and many don't
bother providing SNMP access to untrusted parties, so the features may
not be all that interesting.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 23 Sep 2004 16:08:34 +0200

On Thu, Sep 23, 2004 at 07:51:24AM +0300, Pekka Savola wrote:
 
> authentication.

[...]
 
> would indeed be higher.

This goes back to a rather old discussion whether there are environments
where SNMP writes are used, how big these environments might be (I leave
it to you do define the metric) and whether the IETF should worry about 
these environments. There are two camps, one arguing that SNMP writes 
are just an illusion since nobody actually uses them.  The other camp 
claims that SNMP writes are a reality (or believes they will become a 
reality once all the security issues have been solved).

To this end, there was never a real investigation to sort this out. It
would be more than interesting to collect packet traces from real-world 
networks (and not just ISP IP networks since SNMP seems to be used quite 
a bit in telco networks, cable networks, enterprise networks largely 
based on IEEE 802 LANs, ATM networks, ...) just to see which features 
of SNMP are used and to which extend and for which purpose. The NMRG 
is (slowly) working on creating up a measurement infrastructure (means 
easy to use tools) which will hopefully lead to answers to some of 
these questions. If you are running networks and want to help with 
this, please get in contact with me since we need to create a pool 
of people running very different networks who help us to get the 
necessary data we need.

Bottom line: We do not really know how SNMP is used in practice.
Different opinions do exist and debating them is at the end wasted
time. We therefore need to collect facts and I believe this is not
too hard to do, even taking privacy issues related to packet traces 
into account.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: Robert Story <[email-masked]>
Date: Thu, 23 Sep 2004 12:16:57 -0400

On Thu, 23 Sep 2004 16:08:34 +0200 Juergen wrote:
JS> This goes back to a rather old discussion whether there are environments
JS> where SNMP writes are used, how big these environments might be (I leave
JS> it to you do define the metric) and whether the IETF should worry about 
JS> these environments. There are two camps, one arguing that SNMP writes 
JS> are just an illusion since nobody actually uses them.  The other camp 
JS> claims that SNMP writes are a reality (or believes they will become a 
JS> reality once all the security issues have been solved).

SNMP writes are a reality. I personally have developed at least 3 SNMP agents
with write support that interface with existing proprietary control mechanisms.

JS> To this end, there was never a real investigation to sort this out. It
JS> would be more than interesting to collect packet traces from real-world 
JS> networks (and not just ISP IP networks since SNMP seems to be used quite 
JS> a bit in telco networks, cable networks, enterprise networks largely 
JS> based on IEEE 802 LANs, ATM networks, ...)

All of the agents were for clients in the cable industry who were adding SNMP
support under pressure from their customers.

All used SNMP v1/v2c, relaying on a non-public network for access control.

-- 
Robert Story; NET-SNMP Junkie
<irc://irc.freenode.net/#net-snmp>   <http://www.net-snmp.org/>

You are lost in a twisty maze of little standards, all different.

---

From: "David T. Perkins" <[email-masked]>
Date: Thu, 23 Sep 2004 09:58:02 -0700 (PDT)

HI,

Do you use syslog? Are you dissatisfied with it? Do you know it's
limitations?

If you answsered "yes" to any of the above, then I believe that
SNMPv3/SBSM will provide you great benefit.

In SNMPv3/USM, the mechanisms for administering notifications
was, I believe pretty horrible. However, I believe that using
SNMPv3/SBSM with a little work on the MIB modules for notification
targets and loggings, then we will have a real winner.

And, all of the below I believe, but I also believe that with
SNMPv3/SBSM it will be even easier to deploy a new system than 
what is required for SNMPv1 and SNMPv2c.

> not be all that interesting.

Regards,
/david t. perkins

---

From: Robert Story <[email-masked]>
Date: Thu, 23 Sep 2004 11:28:57 -0400

---

From: "Thomas D. Nadeau" <[email-masked]>
Date: Thu, 23 Sep 2004 15:28:41 -0400

> with write support that interface with existing proprietary control 

	Being a reality and actually being used are two different things.
I too have developed numerous modules that are writable, but not many
people use them. :P  Like SNMP writes, Betamax is a reality for only
the few that use it, but for the majority there are 1,000 reasons why
they use something else. *)

	--Tom

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 23 Sep 2004 21:32:46 -0700

>>>>> On Thu, 23 Sep 2004 15:28:41 -0400, "Thomas D. Nadeau" <[email-masked]> said:

Thomas> Being a reality and actually being used are two different things.
Thomas> I too have developed numerous modules that are writable, but not many
Thomas> people use them.

I sure get an awful lot of questions about an operation that
supposedly isn't used.

[note the recent ISMS survey results (see the proceedings) had about
1/5th of the responses saying they used SNMP for configuration]

-- 
Wes Hardaker
Sparta

---

From: Chris Elliott <[email-masked]>
Date: Fri, 24 Sep 2004 00:54:24 -0400 (EDT)

We (Cisco Systems) sell, mostly to enterprises, a network management
system (CiscoWorks) that requires SNMP write access for much of it's
functionality and I have personally worked with many Fortune 100 companies
that are using this NMS and allowing SNMP write access to their network
devices, along with countless smaller companies.

We also sell a large number of DOCSIS-compliant devices. DOCSIS requires
SNMP write access for configuration and provisioning.

We sell other network management systems into the service provider market
that require SNMP write access to the managed devices. They continue to
sell and be used.

SNMP, with write access, is in use today in many environments. These
customers typically are using this write access with insecure community
strings and are securing access with access lists and private management
networks.

I believe that the advantages of using a secure protocol, such as SNMPv3,
along with the ability to authenticate against existing user databases,
will be easier to deploy and more secure than the existing methods.

Chris.

> 1/5th of the responses saying they used SNMP for configuration]

Chris Elliott  CCIE# 2013       |         |
Customer Diagnostic Engineer   |||       |||
RTP, NC, USA                  |||||     |||||
919-392-2146              .:|||||||||:|||||||||:.
[email-masked]        c i s c o S y s t e m s

---

From: "EricLKlein" <[email-masked]>
Date: Fri, 24 Sep 2004 17:23:50 +0200

I tend to agree with Chris, many service providers are starting to wake up
to the lack of security in SNMP I and II, and have started requiring
compliance in the NMS / OSS products that they want.

SNMP III is the best solution for this so far and is important.

Eric
----- Original Message ----- 
From: "Chris Elliott" <[email-masked]>
To: "Wes Hardaker" <[email-masked]>
Cc: "Thomas D. Nadeau" <[email-masked]>; <[email-masked]>;
<[email-masked]>
Sent: 24 September, 2004 6:54 AM
Subject: Re: [Isms] Why SNMPv3? [WG Review: Integrated Security Model for
SNMP (isms)]