Subject: RE: [Isms] #32: is the securityName=username default OK?

From: "Nelson, David" <[email-masked]>
Date: Tue, 25 Oct 2005 10:19:57 -0400

David B Harrington writes...

> Remember that ISMS supplements USM.

I think of ISMS as an alternative to USM.

> USM requires a local configuration
> dependency, therefore we cannot eliminate it.

Well, even ISMS will require some local configuration.  It will also be
dependent on local configuration of the SSH server.  That being said,
the *type* of local configuration that makes USM difficult to deploy is
per-user information.  The most basic concept of AAA systems is to store
all per-user information on centralized servers.  I think that requiring
ISMS to have per-user (or per-meta-user) configuration stored on each
managed entity defeats the purpose.  Requiring the local configuration
of authentication mechanisms, shared secrets and AAA server addresses
is, of course, to be expected.

> One reason why we have securityName is so that a system logging
> facility that logs changes to the SNMP system can use a human-readable
> name in the log - the securityName. We have no guarantee that the
> tmSecurityName is human-readable.

AAA systems almost always authenticate humans.  Even when they don't,
the protocols have been designed for authentication of humans.  That
pretty much guarantees that the basic identity nomenclature (the
username) will be human readable, because it has to be human writeable
(e.g. entered by a human at a keyboard).  I believe you can assume and
require that tmSecurityName be human readable without any loss of
generality, even when the credentials are in a more complex form, such
as digital certificates.

> The more obvious reason for securityname is to allow multiple
> authentication mechanisms to map to a common securityname for a user
> (or a group of users, or whatever) for use by the access control
> system.

Grouping multiple users into policy groups is the domain of the AAA
server, not the AAA client, and therefore not ISMS.

> I do not believe all organizations will always have only one mechanism
> for authenticating all people and other entities (such as
> applications), regardless of the device from which they are
> authenticating, the firmware version of the device from which they are
> authenticating, or the location from which they are authenticating.
> Having a mechanism to bind multiple mechanism-specific identities to
> one SNMP identity seems a good thing.

It is true that organizations sometime use multiple legacy
authentication mechanisms.  When it is technically feasible,
organizations will most often back-end each of these disparate
mechanisms with the same user identity repository, i.e. implement a form
of single-sign-on.  For ISMS to succeed, it must not only accommodate
multiple authentication mechanisms (those supported or supportable by
SSH), it must remove any dependencies on per-user configuration on each
managed entity.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Sam Hartman <[email-masked]>
Date: Tue, 25 Oct 2005 18:36:30 -0400

>>>>> "Nelson," == Nelson, David <[email-masked]> writes:

    Nelson,> AAA systems almost always authenticate humans.  Even when
    Nelson,> they don't, the protocols have been designed for
    Nelson,> authentication of humans.  That pretty much guarantees
    Nelson,> that the basic identity nomenclature (the username) will
    Nelson,> be human readable, because it has to be human writeable
    Nelson,> (e.g. entered by a human at a keyboard).  I believe you
    Nelson,> can assume and require that tmSecurityName be human
    Nelson,> readable without any loss of generality, even when the
    Nelson,> credentials are in a more complex form, such as digital
    Nelson,> certificates.

I believe that assuming Tmsecurityname is human readable is in general
false.  There are too many complicated problems having to do with
choosing the right name and various things people want to put in a
name.

I believe that you can assume the ssh username is human readable and
agree with david that you do not want per-user configuration.

--Sam

---

From: "Randy Presuhn" <[email-masked]>
Date: Tue, 25 Oct 2005 19:44:32 -0700

Hi -

> From: "Sam Hartman" <[email-masked]>
> To: "Nelson, David" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Tuesday, October 25, 2005 3:36 PM
> Subject: Re: [Isms] #32: is the securityName=username default OK?
...
> agree with david that you do not want per-user configuration.
...

By the time one gets to VACM, it will have to have been somehow
trasformed into an SnmpAdminString (that's the syntax of
vacmSecurityName, UTF-8) which means there's a fairly strong
assumption that it's going to be seen by humans.  The textual
convention is written to cope with non-displayable stuff, but the
advice on its use in RFC 3411 seems pretty clear.

Randy