Subject: RE: [Isms] ISMS Operational Scenario/Goal

From: "Nelson, David" <[email-masked]>
Date: Mon, 28 Feb 2005 17:05:48 -0500

David Perkins writes...

> One final note....
> To use SNMPv3/ISMS, the information that is needed is
> ONLY the IP address of the system to be managed, a user
> identity, proof of the user identity, and verifier or
> the identity of the managed system. An examples of this
> last part include the SSH fingerprint, or the CA cert
> of the managed system's cert. There SHOULD NEVER be
> a requirement that there be an IP address and/or key
> for a Radius server. They are not needed now for management
> via SSH or via a WEB browser.

I think this is an {unfortunate | undesirable | mistaken} requirement.
I specifically object to the notion that "the SSH fingerprint, or the CA
cert of the managed system's cert" are acceptable configuration
prerequisites but "the IP address and/or key for a Radius server" are
not acceptable.  That distinction "cooks the books" in terms of
eliminating potential solutions from consideration. If you want to use
just about any commercially deployed AAA client-server system, then the
AAA clients will need to share pre-configured credentials with the AAA
server.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David T. Perkins" <[email-masked]>
Date: Mon, 28 Feb 2005 14:17:36 -0800 (PST)

HI,

Show me now where management users need IP address and
secret of Radius server to perform management. We
are talking about reducing the operational costs,
not increasing them! This is not some intellectual
exercise to show how smart we are. It's to get
SNMP in use at the lowest incremental operational
(not capital) cost to operators (not to device
vendors either).

> AAA clients will need to share pre-configured credentials with the AAA
Regards,
/david t. perkins