Subject: RE: [Isms] RE: Radext attributes

From: "Nelson, David" <[email-masked]>
Date: Mon, 31 Oct 2005 10:54:36 -0500

Eliot Lear writes...
 
> I think you two are talking about two different "establishment"s.

Perhaps...

> In Kaushik's case he's saying that the SSHSM subsystem has not 
> been started and so it can provide no hints to radius *unless* a 
> separate port is in use.

My suggestion was that it is possible to defer RADIUS authentication
until SSHSM starts, and let it do the RADIUS Client calls.  I have seen
implementations of Telnet over SSH where this approach has been taken.
SSH supplies privacy and Telnet (CLI "login" session) provides
authentication and authorization.

I'm not suggesting that to be the preferred implementation, just
observing that it is a possible implementation.

> (It is possible albeit arguably undesirable to accomplish the same
> task based on specific usernames, but I think we'd all agree that's
just
> plain ugly).

Agreed.

So, if I understand the flow correctly, a "generic" SSH session is
opened between manager and agent (OK, for the purists, between the
peers).  After that has occurred, SSHSM then uses the SSH session to
spawn an SSMSM session.  Is that the model?  What system component (e.g.
listener) is the SSH session connected to at the agent, that receives
the command to initiate an SSHSM session?

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Eliot Lear <[email-masked]>
Date: Mon, 31 Oct 2005 17:30:33 +0100

> the command to initiate an SSHSM session?

If I understand SSH parlance correctly this would be part of the 
connection service, at the same point as "session" or "netconf".

Eliot