Subject: Re: [Isms] Limited time to charter

From: Sam Hartman <[email-masked]>
Date: Thu, 11 Aug 2005 17:56:17 -0400

>>>>> "David" == David B Harrington <[email-masked]> writes:

    David> However, to solve the integration issue, we really need to
    David> understand how to step-wise integrate from one portion to
    David> the next until we have a solution that ties in the security
    David> infratsructure all the way from the application framnewokrs
    David> down to SNMP-specific mappings to securityModel,
    David> securityName, and securityLevel.

    David> I believe that getting the mappings between SNMP and SSH
    David> (or any other next-hop protocol) provides one link in the
    David> many steps that need to be resolved. Then we need to
    David> discuss how SSH will link to AAA and/or local accounts, and
    David> then how the AAA protocols will integrate with the
    David> applications.

If you can convince the rest of the working group that this is the
technical direction they need to follow and can write a charter that
reflects this technical direction, that sounds like it would meet the
August deadline.

For a variety of reasons I think that such a charter probably would
need to have specifics about which protocol you ar encapsulating.
Without that I would be somewhat concerned that we're not going to get
focus.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 11 Aug 2005 19:34:38 -0400

Hi,

So do we have any volunteers to work on documenting how SSH
authenticates its users using RADIUS or Kerberos, and makes the model
(e.g. RADIUS), user (user-auth), and level (authentication and
encryption services) accessible in a standard manner within SSH, or in
an SSH-API for protocols using SSH services?

Given these mappings between SSH and RADIUS, and a way to access these
mappings, a TMSM model based on SSH can translate that into
securityModel, securityName, and securityLevel for SNMP usage. I'm
working on the SNMP-to-SSH interface, and have done initial passes at
SNMP-to-TLS, and SNMP-to-DTLS, and SNMP-to-SASL, but we need more.

Do we have volunteers to write an SSH-to-RADIUS document? Or
SSH-to-TACACS+, or SSH-to-Kerberos or SSH-to-PKI? Since these are
reputedly used for accessing the CLI subsystem, there must be people
who understand how to provide such mappings. Or maybe we need an
SSH-to-CLI-to-RADIUS, and SSH-to-CLI-to-XXXX mapping, and so on.

Who's willing to commit to doing some writing?

David Harrington
[email-masked]

> -----Original Message-----
> From: Sam Hartman [mailto:[email-masked]] 
> Sent: Thursday, August 11, 2005 5:56 PM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]; [email-masked]; 
> [email-masked]; [email-masked]
> Subject: Re: [Isms] Limited time to charter
>