Subject: RE: [Isms] TLS / SSH scalability concerns

From: "McDonald, Ira" <[email-masked]>
Date: Tue, 17 May 2005 11:16:32 -0700

Hi,

I agree with Wes and Marcus - Tom Petch's premise that it's okay
to collect statistics in a non-secure manner is fatally flawed.

There was lots of discussion some time back on this list around
the idea that you shouldn't "waste" the overhead of security for
SNMP Get requests/responses.  This is just plain wrong, unless
you don't care if your statistics (and their apparent sources)
have been hacked.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Blue Roof Music / High North Inc
PO Box 221  Grand Marais, MI  49839
phone: +1-906-494-2434
email: [email-masked]

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]On
> Behalf Of Wes Hardaker
> Sent: Tuesday, May 17, 2005 1:21 PM
> To: Tom Petch
> Cc: [email-masked]
> Subject: Re: [Isms] TLS / SSH scalability concerns
> 
> 
> >>>>> On Tue, 17 May 2005 11:40:06 +0200, "Tom Petch" 
> <[email-masked]> said:
> 
> Tom> The SNMP manager polling the interface table on n,000 agents
> Tom> every 30 second does not need and should not be using security.
> 
> Err...  Riiiigght.
> 
> I'm glad those ever important SETs will be done securely at least.
> Even though the decision about whether to send them might be based on
> insecure data.
> 
> -- 
> Wes Hardaker
> Sparta, Inc.
> 
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/isms
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Tom Petch" <[email-masked]>
Date: Tue, 17 May 2005 19:21:17 +0200

Just to clarify, I did not have in mind the gathering of statistics.  What I see
SNMP managers do is poll at regular intervals - 30s is typical - in order to
maintain a view of which agents are ok and which are not.  Some poll using the
system group, some use the interface table.  So my reference is not to
statistics but to the work of maintaining the display of suitably coloured icons
on the monitor.

As you gather, I do not see that as needing much security but am interested to
hear different points of view.

Tom Petch
----- Original Message -----
From: "McDonald, Ira" <[email-masked]>
To: "'Wes Hardaker'" <[email-masked]>; "Tom Petch"
<[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, May 17, 2005 8:16 PM
Subject: RE: [Isms] TLS / SSH scalability concerns

---

From: Wes Hardaker <[email-masked]>
Date: Tue, 17 May 2005 13:11:25 -0700

>>>>> On Tue, 17 May 2005 19:21:17 +0200, "Tom Petch" <[email-masked]> said:

Tom> So my reference is not to statistics but to the work of
Tom> maintaining the display of suitably coloured icons on the
Tom> monitor.

Tom> As you gather, I do not see that as needing much security but am
Tom> interested to hear different points of view.

If you don't care about the accuracy of those red and green lights,
then I agree.  I doesn't need to be secure.  I, for one, would kind of
like to know that a device is truly green when I'm looking for problems.

-- 
Wes Hardaker
Sparta, Inc.