Subject: [Isms] Re: Authentication and access control requirements

From: Sam Hartman <[email-masked]>
Date: Sun, 26 Jun 2005 09:46:43 -0400

For ISMS to be useful, I think it is critical that ISMS not create a
bunch of additional requirements on the principals of the underlying
credential system.

If I as an operator only have permanent keys for applications then
that's probably what I'm going to want to use as targets of
notifications.  If there are user keys available then I'll use them.

The whole point of ISMS is to take advantage of the underlying
credentials.  If you add significant requirements beyond that, then
you might as well deploy USM.

Moreover, in a lot of the systems we're discussing, the underlying
credentials will not tell you whether they are a user, application or
host.  (I don't think they will ever really be host credentials, but I
could see how someone might view TLS certificates that way.)

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Sun, 26 Jun 2005 20:25:21 -0400

Hi Sam,

I started this thread to discuss just which SNMPv3 requirements/goals
must be met, and how those requirements compare to the
concepts/capabilities of SSH, since SSH seems to be getting the
greatest amount of discussion. I am not trying to set new requirements
for an underlying credential system; I am trying to determine whether
the requirements and goals that have already been defined for SNMPv3
are still applicable, and how using SSH will meet them.

The charter says "A solution must not modify the other aspects of
SNMPv3 protocol as
defined in STD 62". As one of the authors of the architecture
document, and a co-chair of the SNMPv3 WG, I'm trying to be sure that
any solution is compatible with the concepts of, and the requirements
met by, the existing SNMPv3 architecture, or that any deviation from
the existing SNMPv3 architecture is done knowingly and deliberately.

SNMPv3 was designed to allow various types of principals to be
represented, in order to meet various specific requirements of the
operator and NMS-developer communities. I am interested in
understanding how the SSH concepts fit into the SNMPv3 architecture.
Does SSH support authenticating users and applications and other
principals, or is SSH restricted to certain types of principals?

> bunch of additional requirements on the principals of the underlying

I agree, if the underlying credential system can meet the
requirements/goals of SNMPv3. If the underlying credential system
doesn't support the same requirements, then we should discuss the
impact to SNMPv3 of using said credential system.

David Harrington
[email-masked]

> -----Original Message-----
> From: Sam Hartman [mailto:[email-masked]] 
> Sent: Sunday, June 26, 2005 9:47 AM
> To: [email-masked]
> Cc: 'Tom Petch'; [email-masked]
> Subject: Re: Authentication and access control requirements
> 
>