Subject: RE: [Isms] ISMS Operational Scenario/Goal

From: "Nelson, David" <[email-masked]>
Date: Mon, 28 Feb 2005 17:39:10 -0500

Dave Perkins writes...

> Show me now where management users need IP address and
> secret of Radius server to perform management.

If you simply want to allow remote management of devices that provides
for data confidentiality of the management "session", without providing
the "single sign-on" infrastructure of an Authentication, Authorization,
and Accounting (AAA) system, then you're correct -- no client-server
relationship is required.

I think you miss the point about minimizing OpEx costs, however.
Failing to utilize the existing AAA infrastructure, and instead relying
on disjoint authentication mechanisms, is exactly the "cost" we are
attempting to avoid, IMHO. 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David T. Perkins" <[email-masked]>
Date: Mon, 28 Feb 2005 14:58:27 -0800 (PST)

HI,

You are just not following. Let me give an example.

When using SSH, the user of SSH does not know anything
about Radius servers. The user doesn't know how authentication
is done. It's magic. All the user knows is the IP address
of the system to connect to, the user's ID, the user's
password, and the fingerprint of the SSH server on the
system. Now, if the operator that set up the system
want AAA, they set it up by configuring the managed
system to use Radius authentication, accounting,
and authorization. Again, the user does not know
what is going on "behind the curtain".

What is needed with a new SNMP security model is
something that requires no new work, nor new
information to be held by users to run SNMP
management applications. And it uses what ever
existing security infrastructure. That is what
I'm saying. Use existing infrastructure. Use
existing information.

> attempting to avoid, IMHO. 

Regards,
/david t. perkins

---

From: "David B Harrington" <[email-masked]>
Date: Mon, 28 Feb 2005 18:15:37 -0500

Hi, David P,

Isn't the operator that sets up the system also a management user? How
does he use management with AAA centralized user authentication
without having to know the IP address and AAA credentials to set up
the system?

I don't think anybody is arguing that each management user must
provide the IP address and secret in their requests; that is done once
by the operator who sets up the system. Or is there specific text in
one of the proposals or in the documentation for a specific AAA
protocol that you are thinking about? If that is the case, can you
point us to the text so we can all be on the same page?

David Harrington
[email-masked]

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of David T. Perkins
> Sent: Monday, February 28, 2005 5:58 PM
> To: Nelson, David
> Cc: [email-masked]
> Subject: RE: [Isms] ISMS Operational Scenario/Goal
> 
> HI,
>