Subject: RE: [Isms] #1: is it important to support anonymous user accesstoSNMP?

From: "Fleischman, Eric" <[email-masked]>
Date: Mon, 24 Oct 2005 12:49:47 -0700

This discussion appears to me to have been coupling authentication with
authorization. If we permit the authentication of an "anonymous" entity,
then the question of whether or not that entity is authorized to do
anything useful is a policy issue. I propose that we support a wide
variety of authentication alternatives and that those alternatives are
then mapped to various authorization results via locally defined
policies. Given this, one can bind SSH with the authentication identity
(which is what I interpret your email message as implying) but the
authorization that entity experiences is a function of the
locally-defined policies.

-----Original Message-----
From: Salowey, Joe [mailto:[email-masked]] 
Sent: Friday, October 21, 2005 9:37 AM
To: [email-masked]; Blumenthal, Uri; [email-masked]
Subject: RE: [Isms] #1: is it important to support anonymous user
accesstoSNMP?

Since it seems like we are talking about unauthenticated access I see
this as more of an operational issue than something that would require
much, if any, protocol specification.  If unauthenticated access is
really required then operational conventions can be developed to support
this within the current authentication framework of SSH.  

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Mon, 24 Oct 2005 17:29:49 -0400

Hi,

Comments inline. 

> From: Fleischman, Eric [mailto:[email-masked]] 

> I propose that we support a wide
> policies. 

In SNMPv3, we have an authentication subsystem and an access control
subsystem. It will always be that an entity that is authenticated (or
not, using noAuthNpPriv) will then be mapped to authorization policies
using securityName.

Personally, rather than seeing support for a wide variety of
authentication alternatives, I'd like to see us support the
widely-deployed SSH authentication mechanisms that serve SNMP needs. I
am willing to accept that we should support any authentication
mechanism REQUIRED or RECOMMENDED for use with the SecSH standard.

Is anonymous SSH authentication supported by the secsh standards?

The question is really, does SSHSM need to support an authentication
mechanism so anonymous entities can have access to raw SNMP data?

I can see use-cases for anonymous access to a system, such as for FTP
downloads of publicly accessible information, but I have difficulty
seeing use-cases for anonymous SNMP access to a system, and I am
concerned that adding this feature that has never existed in SNMP
(although "public" is pretty close to anonymous) will increase the
complexity of SSHSM with no real benefit to justify the added
complexity.

I personally believe it is NOT important to support anonymous SNMP
access to SNMP data, and it is not important that SSHSM support this.

David Harrington
[email-masked]

---

From: Sam Hartman <[email-masked]>
Date: Mon, 24 Oct 2005 18:15:57 -0400

>>>>> "David" == David B Harrington <[email-masked]> writes:

    David> Personally, rather than seeing support for a wide variety
    David> of authentication alternatives, I'd like to see us support
    David> the widely-deployed SSH authentication mechanisms that
    David> serve SNMP needs. I am willing to accept that we should
    David> support any authentication mechanism REQUIRED or
    David> RECOMMENDED for use with the SecSH standard.

I think as a matter of architectural sanity you need to support any
authentication mechanism that works with the ssh protocol regardless
of whether it is recommended for use.

    David> Is anonymous SSH authentication supported by the secsh
    David> standards?

Sure.  Two ways.  The easiest is that the server simply returns
success when you start user authentication instead of giving you
methods to choose from.  I've also seen servers that offer
keyboard-interactive and when you select it simply return success.
The second is that you have some well known credential.

--Sam

---

From: "Randy Presuhn" <[email-masked]>
Date: Tue, 25 Oct 2005 00:33:17 -0700

Hi -

> From: "Fleischman, Eric" <[email-masked]>
> To: "Salowey, Joe" <[email-masked]>; <[email-masked]>; "Blumenthal, Uri" <[email-masked]>; <[email-masked]>
> Sent: Monday, October 24, 2005 12:49 PM
> Subject: RE: [Isms] #1: is it important to support anonymous user accesstoSNMP?
>

> locally-defined policies.
...

To make it really concrete, if we assume the security adminstrator is
reasonably sane, the permissions granted to "anonymous" would probably
be identical to those given to "public".  The difference (with respect to
using "public" with USM or SNMPv1 or SNMPv2) is that the user could
have reasonable assurance that the data being retrieved was not tampered
with or spoofed, and, optionally, was protected from evesdroppers.

Randy