Subject: [Isms] ISMS Operational Scenario/Goal

From: "David T. Perkins" <[email-masked]>
Date: Mon, 28 Feb 2005 12:13:58 -0800

HI,

The ISMS WG was chartered to develop a new security model for
SNMPv3 to reduce the operational costs to deploy and for on-going
operations with respect to identity authentication. The charter
explicitly ruled out working on reducing the operational cost
of authorization in the first phase.

So what does this mean? Well, this was shown in detail at the
first BOF. This message is a review of the operational cost
scenarios.

There are many types of network equipment with variation on
their hardware and procedures for initial deployment and
ongoing operations. Below is the description of two representative
boxes. (If you don't believe that these boxes are representative,
then create another description.)

Representative Network Equipment
--------------------------------
1) System description
   a) It has a serial interface that a "terminal" is connected to
       that is used for initial configuration and management
   b) It has an Ethernet interface (typically 10/100) for management
   c) It can support a redundant Ethernet interface for management
   d) It has other interfaces for "user traffic", which may also
      be used for in-band management traffic
   e) It supports CLI management via the serial interface; telnet
      and ssh over the Ethernet management interface(s); and
      possibly ssh over the "user traffic" interfaces
   f) It supports WEB and SNMP management over the Ethernet
      management interface(s), and possibly over the "user
      traffic" interfaces
   g) It has a button to reboot the box, and the boot up
      has a way to "break in" on a terminal connected to
      the serial port so that instead of a normal startup
      the configuration can be erased (so the box will be
      like it was when it can from the manufacturer).
   Initial deployment
   a) System software is present on the box from the manufacturer
   b) There is no configuration, and the only way to communicate
      with the box is via CLI commands on a terminal connected
      to the serial port
   c) There is no operation of the Ethernet management interfaces
      nor operation of the user data interfaces.
   d) there is a single user called "admin" on the box with
      a zero length password.
   e) On boot, the box prompts for user and password.
   f) After successfully logging on to the box, the configuration
      can be changed.
   g) the password for user admin would be changed.
   h) IP configuration (such as IPv4 address, network mask,
      default router, etc) is specified for a management port
   i) ssh service is enabled, and a RSA key pair is configured
      for the ssh server
   j) either a key pair and self-signed X.509 cert is generated,
      or certs in PKCS#12 format are loaded (the protected content
      of info in PKCS#12 format would contain a CA-CERT, 
      the box's keypair, and the box's X.509 cert).  
   h) a CLI script is run from a configuration system over 
      an ssh connection to set up:
       1) any additional local accounts
       2) the ip address and shared key for each
          radius server that is to be used
       3) any policy rules about where management can take
          place, such as "local accounts" can be used only
          over the serial and management interface
       4) the rest of the configuration is done so that
          the device can perform it's role in the network
   On going
   a) As new operators are added, new accounts are added
      to the Radius server(s)
   b) When an operator's password is changed, it is changed
      at the Radius server(s)
   c) When an operator's account is disabled (say, due to, say,
      time of day, day or week, vacation/holiday), the account
      is disabled at the Radius server
   d) When an operator's account is closed, it is closed at
      the radius server
 
2) System description
   a) It has no serial interface
   b) It has an Ethernet interface (typically 10/100) for management
      and "user traffic"
   c) It has other interfaces for "user traffic", which may also
      be used for in-band management traffic
   d) It supports CLI management via ssh over the Ethernet interface,
      and possibly over the "user traffic" interfaces
   f) It supports WEB and SNMP management over the Ethernet interface
      interface, and possibly over the "user traffic" interfaces
   g) It has a button to reboot the box, and a second button
      that is used to clear the configuration back to "factory defaults".
      If the first button is pressed, the box reboots. If second button
      is held pressed in while the box is booting, the configuration
      is cleared so the box will be like it was when it can from the
      manufacturer.
   Initial deployment
   a) System software is present on the box from the manufacturer
   b) There is no configuration, and the only way to communicate
      with the box is via the Ethernet interface.
   c) The box provides a very simple DHCP service, and a simple
      WEB server, and uses the IP address of 192.168.1.1.
   d) A PC or workstation is connected directly to the box, and
      uses DHCP to obtain an IP address. A Web browser is
      opened, and any HTTP URL is redirected to the box,
      and the user is guided through screens to configure
      the initial configuration for the box. This includes:
      1) the password for user admim
      2) the IP configuration (such as IPv4 address, network mask,
         default router, etc) for the Ethernet interface
      3) the ssh service is enabled, and a RSA key pair is
         configured for the ssh server
      4) either a key pair and self-signed X.509 cert is
         generated, or certs in PKCS#12 format are loaded
         (the protected content of info in PKCS#12 format
         would contain a CA-CERT, the box's keypair, and
         the box's X.509 cert).
      5) the box would be rebooted, and direct connect of the
         PC (or workstation) would be removed.  
   e) a CLI script is run from a configuration system over 
      an ssh connection to set up:
       1) any additional local accounts
       2) the ip address and shared key for each
          radius server that is to be used
       3) any policy rules about where management can take
          place, such as "local accounts" can be used only
          over the serial and management interface
       4) the rest of the configuration is done so that
          the device can perform it's role in the network
   On going
   a) As new operators are added, new accounts are added
      to the Radius server(s)
   b) When an operator's password is changed, it is changed
      at the Radius server(s)
   c) When an operator's account is disabled (say, due to, say,
      time of day, day or week, vacation/holiday), the account
      is disabled at the Radius server
   d) When an operator's account is closed, it is closed at
      the radius server

NOTE: system 1 and 2 differ primarily by one having a serial
 interface and the other not having one. This causes initial
 deployment (and reset to "factory settings") to be done
 slightly differently.

Now, with SNMPv3/USM, extra work must be done and/or specialized
run for initial deployment and ongoing operations.

The Goal of ISMS is to develop is security model so that nothing
extra is done. All that is needed is to simply configure the
SNMP agent to support SNMPv3/ISMS. That is nothing is done
to set up SNMP users, change SNMP user keys, or to disable
SNMP users.

One final note....
To use SNMPv3/ISMS, the information that is needed is
ONLY the IP address of the system to be managed, a user
identity, proof of the user identity, and verifier or
the identity of the managed system. An examples of this
last part include the SSH fingerprint, or the CA cert
of the managed system's cert. There SHOULD NEVER be
a requirement that there be an IP address and/or key
for a Radius server. They are not needed now for management
via SSH or via a WEB browser.

Hope this helps.

Regards,
/david t. perkins

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms