Subject: RE: [Isms] securityName

From: "Blumenthal, Uri" <[email-masked]>
Date: Mon, 1 Aug 2005 17:22:39 -0400

> As I've said many times, SNMPv3 authentication is totally unlike all
> other authentication systems in our deployment

No it is not. 

At the moment it's much alike IPsec with manual keying (which
coincidentally is employed by some applications and protocols).

> and my personal goal for
> ISMS is for SNMP to directly leverage an existing authentication
system
> within our deployment.

You seem to be missing the fact that another important issue the WG is
struggling with is mapping of whatever credentials Security System
returns, to ACM rules to obtain access control decisions (without which
authentication is not very useful).

> To the extent that my employer represents the
> large end user, then I suggest that the preferable candidates are
> Kerberos, PKI, Radius, or some other server-based authentication
system
> (including TACACS+). Local accounts just don't cut it because they
don't
> scale. 

And about 30% of the participants will tell you that local accounts is
precisely what would allow them to perform zero-[extra]-touch
deployment...

-----Original Message-----
From: Tom Petch [mailto:[email-masked]] 
Sent: Thursday, July 28, 2005 9:32 AM
To: Kaushik Narayan
Cc: [email-masked]
Subject: Re: [Isms] securityName

----- Original Message -----
From: "Kaushik Narayan" <[email-masked]>
To: <[email-masked]>
Cc: <[email-masked]>
Sent: Sunday, July 17, 2005 5:05 PM
Subject: RE: [Isms] securityName

> Hi David,
>
> Here is a list of external authentication mechanisms that are required

> to be supported from the ISMS charter
>
> - Radius
> - TACACS+
> - Kerberos
> - LDAP
> - Diameter
>

Well, no, that is not what I see or would ever want to see in the
charter because I would regard it as impossible if it weren't that
already.  What I see the charter say is

"The following security infrastructures will be considered by the
working group as potential existing authentication infrastructures to
make use of within the new security model. The solution will hopefully
be able to be integrated with multiple of these user databases although
it is expected that one will be mandatory.

- Local accounts
- SSH identities
- Radius
- TACACS+
- X.509 Certificates
- Kerberos
- LDAP
- Diameter"

So we have to support one, hopefully more than one, never all.  And
notice that the order of the list is that of the percentage currently
using it as revealed in Wes' survey, so support for SSH counts for more
than support for LDAP, by an order of magnitude.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms