Subject: RE: [Isms] Limited time to charter

From: "Nelson, David" <[email-masked]>
Date: Fri, 12 Aug 2005 17:37:58 -0400

Kaushik Narayan writes...

> Most SSH implementations on Unix including OpenSSH support
RADIUS/TACACS+
> authentication via a Pluggable Authentication Module (PAM).

My cursory research this afternoon has led me to this same conclusion.
One further question, however, is whether the PAM API would support
provisioning of the user identity to access control mapping parameter
(whether it be securityName or securityGroup).  In other words, does PAM
support Authorization in addition to Authentication?  The last time I
investigated PAM, it did not.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Kaushik Narayan <[email-masked]>
Date: Fri, 12 Aug 2005 14:45:44 -0700

I am not aware of the PAM API supporting passing of
module specific parameters.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 15 Aug 2005 12:20:04 -0400

>>>>> "Kaushik" == Kaushik Narayan <[email-masked]> writes:

    Kaushik> I am not aware of the PAM API supporting passing of
    Kaushik> module specific parameters.
pam_set_item, pam_get_item could be used for this.  But you would need
support from your module.

---

From: Kaushik Narayan <[email-masked]>
Date: Wed, 17 Aug 2005 16:31:19 -0700

Thanks Sam.

This should work although we still need to figure out how the
module specific attributes (groupName) are passed to the SNMP
engine by the SSH layer.

---

From: Sam Hartman <[email-masked]>
Date: Wed, 17 Aug 2005 22:52:24 -0400

>>>>> "Kaushik" == Kaushik Narayan <[email-masked]> writes:

    Kaushik> Thanks Sam.

    Kaushik> This should work although we still need to figure out how
    Kaushik> the module specific attributes (groupName) are passed to
    Kaushik> the SNMP engine by the SSH layer.

I think that's  out of scope for IETF work.

I do agree that vendors need to discuss that as they consider how to
implement and don't think using this list would be a bad place to have
that discussion.

I also believe that if implementers come back and tell us that they
cannot solve the problem we need to consider that our protocol
probably does not meet their needs.