Subject: RE: [Isms] #1: is it important to support anonymous user access toSNMP?

From: "Glen Zorn \(gwz\)" <[email-masked]>
Date: Thu, 20 Oct 2005 19:34:26 -0700

Miao Fuyou <> supposedly scribbled:

> It may be a practical feature for some scenarios. In the same time I
> believe supporting anonymity is heavily dependent to access control
> policies, and it may not be orthogonal to access control model.  
> 

...

>> From draft-hardaker-snmp-session-sm-03.txt: "SNMP message exchange
> that is authenticated and even private when the session initiator or
> responder is anonymous." 
> 
> This is a new feature provided by SBSM. Can we establish consensus
> that a) this is needed or b) this is not needed? 

Let me get something straight here: we are talking about _management_, right?  I find it really hard to imagine an instance in which we wouldn't care who was managing a device, or the manager wouldn't care what device is being managed...

> 
> David Harrington
> [email-masked]
> 
> 
> 
> 
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/isms
> 
> 
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/isms

Hope this helps,

~gwz

Why is it that most of the world's problems can't be solved by simply
  listening to John Coltrane? -- Henry Gabriel

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Miao Fuyou <[email-masked]>
Date: Fri, 21 Oct 2005 11:53:08 +0800

I don't think anonymous user access implies to managing an anonymous device.
The identities of the managed deviced may(must? anyway "none" public key
algorithm is not defined in SSh draft) be verified, in other word, SSH
server authentication may/must be enabled even in case of anonymous user
access. 

-----Original Message-----
From: Glen Zorn (gwz) [mailto:[email-masked]] 
Sent: Friday, October 21, 2005 10:34 AM
To: [email-masked]
Cc: Miao Fuyou; [email-masked]
Subject: RE: [Isms] #1: is it important to support anonymous user access
toSNMP?

...

> that a) this is needed or b) this is not needed?

Let me get something straight here: we are talking about _management_,
right?  I find it really hard to imagine an instance in which we wouldn't
care who was managing a device, or the manager wouldn't care what device is
being managed...

> [email-masked] https://www1.ietf.org/mailman/listinfo/isms
> 
> 
> [email-masked] https://www1.ietf.org/mailman/listinfo/isms

Hope this helps,

~gwz

---

From: "David T. Perkins" <[email-masked]>
Date: Thu, 20 Oct 2005 23:04:39 -0700 (PDT)

HI,

Maybe you didn't see my previous post on this....

Everywhere today you see examples of "anonymous clients" retrieving
info via an authenticated server via a channel with integrity
and possibly encryption.

Let me provide you an example with SNMP....

Consider a public facility (maybe a library) that has free
network access. Consider management applications that could
be used to determine the availability of some resource
(such as a printer). In this situation, it would be
impractical to give each user a unique identity so
that they could use SNMP to determine the status
of the printers. If the identities of the printers
were not authenticated (or the communication not
integrity checked) then someone could fake that
a printer was unavailable so that they could
have exclusive access.

There are GAZILLION of similar examples! 

> Let me get something straight here: we are talking about _management_, right?  I find it really hard to imagine an instance in which we wouldn't care who was managing a device, or the manager would…
Regards,
/david t. perkins

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 21 Oct 2005 08:47:27 -0400

Hi,

> a printer was unavailable so that they could

The much simpler approach is to give the printer-monitoring
application installed on the public computers its own credentials -
the application is mapped to a securityName, and the application is
allowed to see specific portions of the SNMP data. 

Human users have anonymous access to the application, which has access
to the SNMP data and would presumably interpret the data and display
the interpretation in a form suitable for human consumption.

The users do not need anonymous access to SNMP, and the application
doesn't need to be anonymous either.

David Harrington
[email-masked]