Subject: RE: [Isms] Why SNMPv3? [WG Review: Integrated Security Model forSNMP(isms)]

From: "Fleischman, Eric" <[email-masked]>
Date: Mon, 27 Sep 2004 17:15:00 -0700

How can one securely distribute SNMPv3 passwords or keys associated with human manager-to-SNMP agent access (i.e., privacy keys, authentication keys)? 

How can one get SNMPv3 authentication and privacy to be related to the other authentication and privacy systems in that deployment (e.g., for deployments seeking to do a common role-based access control) -- in terms of common policy and consistent implementation?

How can one get SNMPv3 to participate in generic defense in depth systems common within the non-SNMP elements of the deployment (i.e., to integrate SNMPv3 into the deployment's larger security systems)?

-----Original Message-----
From: David B Harrington [mailto:[email-masked]]
Sent: Monday, September 27, 2004 4:53 PM
To: Fleischman, Eric; 'EricLKlein'; [email-masked];
[email-masked]
Subject: RE: [Isms] Why SNMPv3? [WG Review: Integrated Security Model
forSNMP(isms)]

Hi EricF,

operationally insecure? I hadn't heard this concern. Can you
elaborate? 

dbh 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Fleischman, Eric
Sent: Monday, September 27, 2004 6:06 PM
To: EricLKlein; [email-masked]; [email-masked]
Subject: RE: [Isms] Why SNMPv3? [WG Review: Integrated Security Model
forSNMP(isms)]

However, some of those of us who want to use SNMPv3 USM have found it
to be operationally insecure and would like to have an approach for
SNMP that leverages existing key distribution systems (e.g., PKI,
Kerberos, etc.) already deployed within our infrastructures.

-----Original Message-----
From: EricLKlein [mailto:[email-masked]]
Sent: Friday, September 24, 2004 8:24 AM
To: [email-masked]; [email-masked]
Subject: Re: [Isms] Why SNMPv3? [WG Review: Integrated Security Model
for SNMP(isms)]

I tend to agree with Chris, many service providers are starting to
wake up to the lack of security in SNMP I and II, and have started
requiring compliance in the NMS / OSS products that they want.

SNMP III is the best solution for this so far and is important.

Eric
----- Original Message -----
From: "Chris Elliott" <[email-masked]>
To: "Wes Hardaker" <[email-masked]>
Cc: "Thomas D. Nadeau" <[email-masked]>;
<[email-masked]>; <[email-masked]>
Sent: 24 September, 2004 6:54 AM
Subject: Re: [Isms] Why SNMPv3? [WG Review: Integrated Security Model
for SNMP (isms)]

> We (Cisco Systems) sell, mostly to enterprises, a network management
> system (CiscoWorks) that requires SNMP write access for much of it's
> functionality and I have personally worked with many Fortune 100
companies
> that are using this NMS and allowing SNMP write access to their
network
> devices, along with countless smaller companies.
>
> We also sell a large number of DOCSIS-compliant devices. DOCSIS
requires
> SNMP write access for configuration and provisioning.
>
> We sell other network management systems into the service provider
market
> that require SNMP write access to the managed devices. They continue
to
> sell and be used.
>
> SNMP, with write access, is in use today in many environments. These
> customers typically are using this write access with insecure
community
> strings and are securing access with access lists and private
management
> networks.
>
> I believe that the advantages of using a secure protocol, such as
SNMPv3,
> along with the ability to authenticate against existing user
databases,
> will be easier to deploy and more secure than the existing methods.
>
> Chris.
>
> On Thu, 23 Sep 2004, Wes Hardaker wrote:
>
> > >>>>> On Thu, 23 Sep 2004 15:28:41 -0400, "Thomas D. Nadeau"
<[email-masked]> said:
> >
> > Thomas> Being a reality and actually being used are two different
things.
> > Thomas> I too have developed numerous modules that are writable,
but not
many
> > Thomas> people use them.
> >
> > I sure get an awful lot of questions about an operation that
> > supposedly isn't used.
> >
> > [note the recent ISMS survey results (see the proceedings) had
about
> > 1/5th of the responses saying they used SNMP for configuration]
> >
> > --
> > Wes Hardaker
> > Sparta
> >
> > _______________________________________________
> > Isms mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/isms
> >
>
> Chris Elliott  CCIE# 2013       |         |
> Customer Diagnostic Engineer   |||       |||
> RTP, NC, USA                  |||||     |||||
> 919-392-2146              .:|||||||||:|||||||||:.
> [email-masked]        c i s c o S y s t e m s

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms