Subject: RE: [Isms] achieving market saturation with ISMS

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 24 Feb 2005 09:23:57 -0500

> Here's what bugs me about local accounts:
> The effort required to provision and maintain local accounts is
arguably
> even greater than that required to maintain USM users, because at
least
> the USM user maintenance is easily accomplished remotely through a
> highly standardized interface.  If USM is too much work, then how
would
> making local accounts be an improvement?

IMHO, the answer is "Simply Not My Problem". I think that proponents of
this approach hope that local accounts somehow will have to be
provisioned [for the box to function properly] AND SOMEBODY ELSE WILL
HAVE TO TAKE CARE OF THAT. So if they just offer an interface to local
account-based authentication, they'll avoid all the provisioning needs.
:-)

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 24 Feb 2005 10:01:56 -0500

Hi,

I'm a proponent of having local accounts as a fallback to centralized
accounts. I believe this is important for troubleshooting broken
networks when a AAA server or centralized key distribution
infrastructure may not be reachable.

I don't think we should just provide an interface to local accounts
that are somehow provisioned in a way that is "simply not my problem".
I think we should make both provisioning of local accounts and
leveraging centralized accounts part of the SNMPv3 solution. What we
need to do is to show that having SNMP do the provisioning for the
local accounts for all management interfaces would be easier than
provisioning the local accounts of different management interfaces
using different mechanisms. 

The biggest win would be to converge the multiple local account
databases into one consistent local account database that is
manageable using any of the (equivalently-secure) management
interfaces. To do this means we need to develop a standard virtual
data model for a user-authentication database that can be used by the
different user-authentication mechanisms supported by different
management interfaces (e.g. the USM-MIB). 

We would also need to develop equivalent (or at least balanced)
security for each of the management interfaces, so one interface
doesn't provide less protection of the keys than other interfaces. If
SNMPv3 uses its own unique security model, then we'll need to figure
out how to provide equivalenet security for other management protocols
to converge them; it would be easier to achieve equivalent security by
having SNMP adopt the existing security solutions used by other
management interfaces (even if this might mean lessening the strength
of SNMPv3 security to match the other solutions).

David Harrington
[email-masked]

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Blumenthal, Uri
> Sent: Thursday, February 24, 2005 9:24 AM
> To: Randy Presuhn; [email-masked]
> Subject: RE: [Isms] achieving market saturation with ISMS
>