Subject: RE: [Isms] RADIUS ssh and ISMS

From: "Nelson, David" <[email-masked]>
Date: Fri, 12 Aug 2005 14:11:07 -0400

Sam Hartman writes...

> People have argued on this list that that's not very deployable.  In
> particular they believe you need to populate VACM entries for every
> ssh user who might use the system.  Instead there has been some
> discussion of having the security model map the model-specific
> authentication name (the name in the userauth_request message for ssh)
> into some SNMP security name.  The idea is that whatever central
> database is providing your authentication information might also want
> to provide securityname mapping.  Then you would only need to consider
> VACM entries for the range (instead of domain) of that mapping.
> 
> If you believe this is valuable you could create RADIUS attributes to
> store this information.

Greg Weber and I have previously created such a document.  Reference
http://www.ietf.org/internet-drafts/draft-nelson-radius-management-autho
rization-02.txt (note: -02 submitted just today).  One RADIUS attribute
described in this document that relates to the current thread is called
Management-Policy-Id, and it is intended to aid in the mapping of an
authenticated user identity (e.g. RADIUS User-Name) onto various access
control mechanisms, of local scope to the managed entity.  This could
map to securityName as Sam has suggested, or it could map to a
securityGroup, as Randy Presuhn suggested in another recent posting.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 12 Aug 2005 14:52:47 -0400

Keep in mind that securityName is used not only when receiving a
message, but also when generating outgoing messages to map to the
security identity to be used in the sent message. So I'd be careful
about overloading the purpose of securityName.

David Harrington
[email-masked]

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Nelson, David
> Sent: Friday, August 12, 2005 2:11 PM
> To: [email-masked]
> Subject: RE: [Isms] RADIUS ssh and ISMS
> 
> Sam Hartman writes...
>

---

From: Sam Hartman <[email-masked]>
Date: Fri, 12 Aug 2005 15:08:08 -0400

>>>>> "David" == David B Harrington <[email-masked]> writes:

    David> Keep in mind that securityName is used not only when
    David> receiving a message, but also when generating outgoing
    David> messages to map to the security identity to be used in the
    David> sent message. So I'd be careful about overloading the
    David> purpose of securityName.

Fine.  My goal was simply to try and show how you might document and
charter some of the proposals made so far, not trying to advocate any
particular proposal.  I remembered the securityname mapping proposal,
but did not remember the group mapping proposal in enough detail.