Subject: RE: [Isms] Thoughts on Encapsulation

From: "Khanh Nguyen \(khanhvn\)" <[email-masked]>
Date: Thu, 19 May 2005 11:19:17 -0700

> -----Original Message-----
> From: Juergen Schoenwaelder [mailto:[email-masked]] 
> > 
> > Assume that we pick TLS and DTLS (correct me if that's a wrong
> > assumption:) [...]
> 
> I would not drop ssh. Besides insecure telnet, ssh is _the_ 
> protocol to access CLIs and netconf also mandates the support of ssh.

That's a good point, although SSH+DTLS doesn't sound like a 
matching pair (unless we just drop DTLS).  

Khanh

> 
> The other option of course would be to define a netconf 
> extension that effectively tunnels SNMP like requests through 
> netconf. So on the box, you would just process an SNMP like 
> <getnext/> rpc by mapping it on the local SNMP 
> instrumentation and on the manager side you might be be able 
> to provide an API which is similar to your existing SNMP API 
> and then at the end things run over netconf's transport 
> (whatever you choose). Now such ideas are of course clearly 
> out of the scope of the charter of this WG. ;-)
> 
> /js
> 
> -- 
> Juergen Schoenwaelder		    International University Bremen
> <http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 
> 28725 Bremen, Germany
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 20 May 2005 08:42:42 +0200

> matching pair (unless we just drop DTLS).  

And I did not say SSH-DTLS. I said SSH.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: Eliot Lear <[email-masked]>
Date: Fri, 20 May 2005 14:59:09 +0200

I think there is this notion that SSH is some magic thing that all 
service providers implement and therefore want everything they do to 
pass over it.  I'd be happy living with this except it really doesn't 
work in a managed services environment and people are ignoring that. 
This is a major reason why BEEP is appealing (that plus framing and 
windowing).  We need a sufficiently general solution.

BTW, PSKs have their own sets of problems, like preprovisioning of keys, 
again in a managed service environment.

Eliot

---

From: Sam Hartman <[email-masked]>
Date: Fri, 20 May 2005 11:03:16 -0400

>>>>> "Eliot" == Eliot Lear <[email-masked]> writes:

    Eliot> I think there is this notion that SSH is some magic thing
    Eliot> that all service providers implement and therefore want
    Eliot> everything they do to pass over it.  I'd be happy living
    Eliot> with this except it really doesn't work in a managed
    Eliot> services environment and people are ignoring that. This is
    Eliot> a major reason why BEEP is appealing (that plus framing and
    Eliot> windowing).  We need a sufficiently general solution.

In what way does ssh not work in a managed services environment?
Please start by explaining what you mean by managed services
environment; I'm quite unfamiliar with the space you are thinking of.

---

From: Eliot Lear <[email-masked]>
Date: Fri, 20 May 2005 18:00:29 +0200

I'm specifically referring to call-home support where you want the 
managed entity to contact the manager.  You *could* make this work for 
SSH.  I think the protocol supports it.  But nobody's done it (nor seems 
to want to).

Eliot

---

From: Sam Hartman <[email-masked]>
Date: Fri, 20 May 2005 12:18:52 -0400

>>>>> "Eliot" == Eliot Lear <[email-masked]> writes:

    Eliot> I'm specifically referring to call-home support where you
    Eliot> want the managed entity to contact the manager.  You
    Eliot> *could* make this work for SSH.  I think the protocol
    Eliot> supports it.  But nobody's done it (nor seems to want to).

OK, so an extension of the notify problem?

I have seen people configure ssh to do this, but yes, it was a bit
tricky.

---

From: "Randy Presuhn" <[email-masked]>
Date: Fri, 20 May 2005 09:50:46 -0700

Hi -

> From: "Sam Hartman" <[email-masked]>
> To: "Eliot Lear" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Friday, May 20, 2005 9:18 AM
> Subject: Re: [Isms] Thoughts on Encapsulation
>
...

Not just "the notify problem."  It is also an issue for boxes supporting,
for example, RFCs 2981, 3165, or 4011.

Randy

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 20 May 2005 19:28:34 +0200

> work in a managed services environment and people are ignoring that. 

What is a "managed services environment" and what are the reasons why
ssh does not work there?

/js

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 20 May 2005 16:22:57 -0400

Hi Sam,

Can you identify who you saw do this, so we can ask how they did it?

David Harrington
[email-masked] 

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Sam Hartman
> Sent: Friday, May 20, 2005 12:19 PM
> To: Eliot Lear
> Cc: [email-masked]