Subject: RE: [Isms] #19: should RADIUS be exposed outside of SSH?

From: "Nelson, David" <[email-masked]>
Date: Fri, 14 Oct 2005 13:17:40 -0400

> Subject: [Isms] #19: should RADIUS be exposed outside of SSH?

Yes and no.  The details of RADIUS authentication need not be exposed
outside of SSH, except for making the authenticated identity (e.g.
User-Name) available.  The details of RADIUS authorization, which may be
mapped onto, or otherwise impact, SNMP access control mechanisms need to
be exposed to SNMP.

One point that hasn't had much [any] discussion is that AAA services
such as RADIUS and Diameter are designed to provision a specific
service, such as packet forwarding or telnet terminal services.  I
believe that AAA should provision SNMP management access as a specific
service, and therefore a RADIUS authorization for SNMP access should not
be capable of being used for packet forwarding services (or visa versa).
This is another level of authorization that would need to be exposed
beyond SSH.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Randy Presuhn" <[email-masked]>
Date: Fri, 14 Oct 2005 13:44:51 -0700

Hi -

> From: "Nelson, David" <[email-masked]>
> To: <[email-masked]>
> Sent: Friday, October 14, 2005 10:17 AM
> Subject: RE: [Isms] #19: should RADIUS be exposed outside of SSH?
...
> This is another level of authorization that would need to be exposed

I agree that it makes sense to treat SNMP management access as a
separate service.  I wonder whether there would be any value to subdividing
that service into, for example, notification, monitoring, and control services.

Randy

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 14 Oct 2005 20:52:36 -0400

Hi,

I envision the RADIUS management authorization as providing a "named
policy" that refers to an access control policy defined on the managed
device, e.g. in VACM. This would be similar to the FilterID attribute
used for network access policies.

So I would expect the service would be SNMP, and then SNMP deals with
how to apply the details of the named policy; the policy name could be
a VACM groupname, for example, defined and named by the operator to
match their corporate policies.

For compatibility with other mgmt interfaces, such as netconf, RADIUS
would authorize a named policy, and netconf would apply the netconf
access control associated with the named policy. So the servce would
be netconf, but the named policy might be notifications, or
monitoring, or control services, or something more specific like
helpdesk, and defined and named by the operator to match their
corporate policies.
 
David Harrington
[email-masked]

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Randy Presuhn
> Sent: Friday, October 14, 2005 4:45 PM
> To: [email-masked]
> Subject: Re: [Isms] #19: should RADIUS be exposed outside of SSH?
> 
> Hi -
>

---

From: Eliot Lear <[email-masked]>
Date: Sun, 16 Oct 2005 16:16:36 +0200

> This is another level of authorization that would need to be exposed

We should be very careful how we do this.  We do not want to tie SSHSM 
to radius or diameter.  In order to even determine this prior to 
authentication (the specific SNMP subsystem request is made *after* 
authentication) it seems to me that a separate port is required.

Eliot