Subject: RE: [Isms] #8: Do we need a mapping between the SSH key and SNMPengineID?

From: "Kaushik Narayan \(kaushik\)" <[email-masked]>
Date: Fri, 14 Oct 2005 09:10:07 -0700

I think we should consider using/mapping the identity of the SNMP engine
to the SNMP engine ID, this will be particularly useful when you have
multiple SNMP engines on the same host (single SSH server). I am not
quite sure about the spoofing issue since that should be taken care by
server (agent) authentication by the SSH transport protocol.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of David B Harrington
Sent: Thursday, October 13, 2005 2:51 PM
To: [email-masked]
Subject: [Isms] #8: Do we need a mapping between the SSH key and
SNMPengineID?

#8: Do we need a mapping between the SSH key (or other SSH engine
identifier) and SNMP engineID? What happens if an agent "spoofs"
another engineID, and an NMS perfoms a SET of sensitive parameters to
the agent? 

David Harrington
[email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Miao Fuyou <[email-masked]>
Date: Mon, 17 Oct 2005 17:28:02 +0800

SSH transport is different from TCP tranport for SNMP. SSHSM starts a SNMP
agent as subsystem of SSH server contrasting to TCP as forked child process,
it means each subsytem is independent to each other. Will they share same
snmpEngineID, just like in UDP or TCP transporting? In other word, do all
subsystems started by a SSH server are same SNMP entity? 

If not, I believe snmpEngineID must be allocated dynamicaly enough. In such
case mapping SSH key and snmpEngineID is difficult.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Kaushik Narayan (kaushik)
Sent: Saturday, October 15, 2005 12:10 AM
To: [email-masked]; [email-masked]
Subject: RE: [Isms] #8: Do we need a mapping between the SSH key
andSNMPengineID?

I think we should consider using/mapping the identity of the SNMP engine to

the SNMP engine ID, this will be particularly useful when you have multiple
SNMP engines on the same host (single SSH server). I am not quite sure about
the spoofing issue since that should be taken care by server (agent)
authentication by the SSH transport protocol.

-----Original Message-----

#8: Do we need a mapping between the SSH key (or other SSH engine
identifier) and SNMP engineID? What happens if an agent "spoofs" another
engineID, and an NMS perfoms a SET of sensitive parameters to the agent? 

David Harrington
[email-masked]

---

From: "David B Harrington" <[email-masked]>
Date: Tue, 18 Oct 2005 12:52:01 -0400

Hi Maio,

snmpEngineID should not be dynamically generated; that would defeat
the whole purpose of having an engineID - to uniquely and
unambiguously identify an engine within an administrative domain. 

An engine may have multiple addresses, and its addresses may change
over time. But the snmpEngineID provides a consistent managed object
to identify the virtual database of which it is part.

David Harrington
[email-masked]

> From: Miao Fuyou [mailto:[email-masked]] 
> Sent: Monday, October 17, 2005 5:28 AM
> To: 'Kaushik Narayan (kaushik)'; [email-masked]; 
> [email-masked]
> Subject: RE: [Isms] #8: Do we need a mapping between the SSH 
> key andSNMPengineID?
> 
>

---

From: Miao Fuyou <[email-masked]>
Date: Wed, 19 Oct 2005 16:14:00 +0800

Hi, David,

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of David B Harrington
Sent: Wednesday, October 19, 2005 12:52 AM
To: [email-masked]
Subject: RE: [Isms] #8: Do we need a mapping between the SSH
keyandSNMPengineID?

Hi Maio,

snmpEngineID should not be dynamically generated; that would defeat the
whole purpose of having an engineID - to uniquely and unambiguously identify
an engine within an administrative domain. 

An engine may have multiple addresses, and its addresses may change over
time. But the snmpEngineID provides a consistent managed object to identify
the virtual database of which it is part.

David Harrington
[email-masked]

> [email-masked] https://www1.ietf.org/mailman/listinfo/isms
> 
> [email-masked] https://www1.ietf.org/mailman/listinfo/isms
> 
>

---

From: Miao Fuyou <[email-masked]>
Date: Wed, 19 Oct 2005 17:27:01 +0800

Hi, David, 

Thanks for your clarification! It is important for me to understand how SNMP
works with SSH. RFC3411 says that snmpEngineID is used to uniquely identify
an engine/entity, but I can't find sentence addressing snmpEngineID must be
kept CONSISTENT even in case of address changes, I think it should be there.

Miao
-----Original Message-----

Hi Maio,

David Harrington
[email-masked]

---

From: "David B Harrington" <[email-masked]>
Date: Wed, 19 Oct 2005 11:46:33 -0400

Hi Maio,

Let me assure you, you are not the first to make this mistake. ;-)

The definition of snmpEngineID in RFC3411 says it should be constant: 

snmpEngineID     OBJECT-TYPE
    SYNTAX       SnmpEngineID
    MAX-ACCESS   read-only
    STATUS       current
    DESCRIPTION "An SNMP engine's administratively-unique identifier.

                 This information SHOULD be stored in non-volatile
                 storage so that it remains constant across
                 re-initializations of the SNMP engine.
                "
    ::= { snmpEngine 1 }

The definition of the SnmpEngineID Textual convention says it is not
for addressing, only identification. I agree it could be clearer that
a change of address does not mean the snmpEngineID should be
regenerated.

David Harrington
[email-masked]

> Sent: Wednesday, October 19, 2005 5:27 AM