Subject: RE: [Isms] #1: is it important to support anonymous user accesstoSNMP?

From: "Blumenthal, Uri" <[email-masked]>
Date: Fri, 21 Oct 2005 09:08:03 -0400

>> Consider a public facility (maybe a library) that has free
>> network access. Consider management applications that could
>> be used to determine the availability of some resource
>> (such as a printer). In this situation, it would be
>> impractical to give each user a unique identity so
>> that they could use SNMP to determine the status
>> of the printers. If the identities of the printers
>> were not authenticated (or the communication not
>> integrity checked) then someone could fake that
>> a printer was unavailable so that they could
>> have exclusive access.
>
>The much simpler approach is to give the printer-monitoring
>application installed on the public computers its own credentials -
>the application is mapped to a securityName, and the application is
>allowed to see specific portions of the SNMP data. 

I agree with Dave Perkins here. "Semi-anonymous" access (where the
server is authenticated to an anonymous client) has its merits, and is
useful for SNMP; for monitoring and not management.

>Human users have anonymous access to the application, which has access
>to the SNMP data and would presumably interpret the data and display
>the interpretation in a form suitable for human consumption.

IMHO this is possible but impractical, at least much less practical than
what Dave P. outlined.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 21 Oct 2005 09:28:59 -0400

This approach is already being used by NMS systems today. I don't see
why it would be impractical.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Blumenthal, Uri
> Sent: Friday, October 21, 2005 9:08 AM
> To: [email-masked]
> Subject: RE: [Isms] #1: is it important to support anonymous 
> user accesstoSNMP?
>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 21 Oct 2005 16:20:22 +0200

> why it would be impractical.

In all fairness, NMS systems also rely on community "public" for a
great deal of their discovery. So even big commercial NMS systems
sometimes like to talk to boxes who are not aware of the NMS identity.

Note that I am not necessarily saying ISMS has to support
authenticated anonymous access - perhaps community "public" is good
enough, even though it is not authenticated.

In fact, does authenticated anonymous access not boil down to "I
configure a well-known (typically read-only) user identity with a
secret that everybody knows about"? If yes, then I don't think ISMS
has to do something special.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany