Subject: RE: [Isms] #2: is server authentication a requirement that SNMPwillrequire

From: "Kaushik Narayan \(kaushik\)" <[email-masked]>
Date: Tue, 18 Oct 2005 09:53:14 -0700

Hi Sam,

Please find my reply inline.

<snipped> 

First, leap of faith (trust the first hostkey you get) probably would be
sufficient for this situation.

Second, I do understand the value of PKI.  I understand that in some
environments it will be used.  ISMS needs to support that.

But the charter goal of ISMS is to work with authentication people use
today.  Today, people do not use X.509 with ssh.  No matter how much
you, I or anyone else wants them to, it simply is not what people
currently do.  So, while ISMS should support it, and while you can (and
should when appropriate) sell products that rely on it, it cannot be our
primary focus.

<Kaushik>

Today the predominant management protocol beyond SNMP (and Syslog) is a
human interface (CLI) where the use of SSH with host keys will work just
fine since the operator is in the loop. The use of CLI as a programmatic
interface within our NMS systems requires manual provisioning of the
device host keys and this is a significant overhead when managing
thousands of devices, additionally pre-provisioning is major use case
within network management systems where the device host keys are not
known in advance. 

Also, even if X.509 is not in use for SSH, other management protocols
that use TLS such as Syslog and NetConf (over BEEP, SOAP) will move
devices in that direction.

Regards,
  kaushik!

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Sam Hartman <[email-masked]>
Date: Tue, 18 Oct 2005 16:31:32 -0400

>>>>> "Kaushik" == Kaushik Narayan (kaushik) <[email-masked]> writes:

    Kaushik> Today the predominant management protocol beyond SNMP
    Kaushik> (and Syslog) is a human interface (CLI) where the use of
    Kaushik> SSH with host keys will work just fine since the operator
    Kaushik> is in the loop. The use of CLI as a programmatic
    Kaushik> interface within our NMS systems requires manual
    Kaushik> provisioning of the device host keys and this is a
    Kaushik> significant overhead when managing thousands of devices,
    Kaushik> additionally pre-provisioning is major use case within
    Kaushik> network management systems where the device host keys are
    Kaushik> not known in advance.

Again, the goal of ISMS is to provide SNMP with support for *today's*
authentication solutions.

--Sam

---

From: Eliot Lear <[email-masked]>
Date: Wed, 19 Oct 2005 06:22:13 +0200

Sam,
> authentication solutions.

It is not so far from the realm of possibility that X.509 will be here. 
  I hope you will agree that if the SSHSM/SNMP subsystem treats SSH as a 
black box with appropriate gazzintas and gazzoutas this shouldn't be a 
problem.

Eliot

---

From: Sam Hartman <[email-masked]>
Date: Wed, 19 Oct 2005 03:09:45 -0400

>>>>> "Eliot" == Eliot Lear <[email-masked]> writes:

    Eliot> Sam,
    >> Again, the goal of ISMS is to provide SNMP with support for
    >> *today's* authentication solutions.

    Eliot> It is not so far from the realm of possibility that X.509
    Eliot> will be here. I hope you will agree that if the SSHSM/SNMP
    Eliot> subsystem treats SSH as a black box with appropriate
    Eliot> gazzintas and gazzoutas this shouldn't be a problem.

Completely.  You might even want to do things like standardize X.509
SubjectAltNames for SNMP engine IDs (or you might not); define a
netconf data model fragment for configuring appropriate trust anchors
and certificate validation policies; etc.  

What I think would be inappropriate is depending on X.509 in the core
ssh SM documents.