Subject: [Isms] Radext attributes

From: "David B Harrington" <[email-masked]>
Date: Fri, 28 Oct 2005 16:27:37 -0400

Hi Dave,

Would SSHSM need to provide the hints that it wants RADIUS to
authorize the "SNMPv3 over SSH" service? 

Would SSH do the RADIUS authentication before establishing the "SNMP"
subsystem? If so, should the SSHSM rules for establishing the SNMP
subsystem include a request for SSH to get RADIUS authorization for
the "SNMPv3/SSH service"?

(I'm deliberately not addressing whether there should be different SSH
subsystems for notifications and request/response, to keep my question
simple).

dbh

> -----Original Message-----
> From: Nelson, David [mailto:[email-masked]] 
> Sent: Thursday, October 27, 2005 5:58 PM
> To: [email-masked]
> Cc: [email-masked]; Juergen Quittek
> Subject: RE: Radext presentation
> 
> Dave,
> 
> This looks good to me.
> 
> The one element that isn't included, and hasn't had much discussion
in
> ISMS, is the notion of the RADIUS-provisioned service.  This 
> is often by
> means of the Service-Type attribute in RADIUS, but other attributes
> sub-specify specific forms of service.  When these "service" 
> attributes
> appear in an Access-Accept message, it tells the managed entity what
> form of service it is to provide.  When these "service" attributes
> appear in an Access-Request message, they provide a hint to the
RADIUS
> server as to what kind of access is being requested by the user.
Most
> RADIUS servers use these hint attributes to select among multiple
> "access profiles" available for a single user identity, enabling the
> server to return the correct set of provisioning attributes in the
> Access-Accept.
> 
> I think it is important that these "service" type of 
> attributes for ISMS
> (i.e. SNMPv3 access over SSH) are also defined, such that the
hinting
> and provisioning behaviors of RADIUS server can explicitly take ISMS
> into account.  These types of attributes and attribute values are
also
> included in the Management Authorization draft.  This doesn't have
any
> direct impact on ISMS, but it will enable ISMS to integrate smoothly
> into existing RADIUS deployments. 
> 
> Regards,
>  
> Dave
>  
> David B. Nelson
> Enterasys Networks, Inc.
> 50 Minuteman Road
> Andover, MA 01810-1008
> Phone: (978) 684-1330  
> E-mail: [email-masked]
>  
> 
> > -----Original Message-----
> > From: David B Harrington [mailto:[email-masked]]
> > Sent: Thursday, October 27, 2005 5:41 PM
> > To: Nelson, David
> > Cc: [email-masked]; 'Juergen Quittek'
> > Subject: Radext presentation
> > 
> > Hi,
> > 
> > This is the first pass of the presentation for RADEXT.
> > Comments welcome.
> > 
> > David Harrington
> > [email-masked]
> 
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "Nelson, David" <[email-masked]>
Date: Fri, 28 Oct 2005 16:46:55 -0400

Dave Harrington writes...
 
> authorize the "SNMPv3 over SSH" service?

It is the RADIUS Client that provides the hints.  The RADIUS Client
decides what hints to include in the Access-Request message based on
which "access service" is requesting authentication.  SSH is often the
layer that makes direct use of RADIUS.  If SSH were to communicate to
the RADIUS Client the additional information that the requested SSH
session is to be used for SSHSM, then the RADIUS Client could use that
information in its hints as well.

> subsystem?

It may be that at the time of SSH session authentication via RADIUS that
SSH doesn't know what service will be run over the session.  Since SSH
needs to eventually re-direct the session to the SSHSM "portal", it
seems that SSH will have the information sooner or later.

It may also depend on implementation.  I have seen Telnet over SSH
implementations where the CLI "login" prompt dialogue is completed
before the CLI session calls RADIUS for authentication.  In that
implementation it is not SSH itself that calls on RADIUS, it is the CLI
session (shell, whatever) that makes the RADIUS call (in place of a
check of /etc/passwd, for example).

So it seems that it is possible for either SSH or SSHSM to make the call
to the RADIUS Client.  While this may be an implementation decision, it
would be helpful to understand the data flow in each scenario.  Having a
clearer understanding of the existing SSH-to-RADIUS implementations may
be of benefit.

> If so, should the SSHSM rules for establishing the SNMP

I believe it would be very helpful if SSH were to know at the time of it
call to the RADIUS Client that the SSH session will be user to carry
SSHSM traffic.  In the alternative, SSHSM could directly call the RADIUS
Client itself, after the SSH session has been established.

---

From: "Kaushik Narayan \(kaushik\)" <[email-masked]>
Date: Fri, 28 Oct 2005 15:13:49 -0700

Hi David,

> If so, should the SSHSM rules for establishing the SNMP subsystem 
> include a request for SSH to get RADIUS authorization for the 
> "SNMPv3/SSH service"?

<Kaushik> I am not sure about the alternative since the user
authentication (RADIUS Access_Request) needs to happen prior to the SSH
session establishment. 

I am not sure there are means to communicate a service name in SSH and
the only option might be run the SSH server on a separate port for
SSHSM.

---

From: "McDonald, Ira" <[email-masked]>
Date: Sat, 29 Oct 2005 15:36:02 -0700

Hi David,

Well if the SNMP over SSH connection arrives over a dedicated port
isn't it easy to 'shim' the SSH library with for the service SNMP?
SSH doesn't run in the kernel, right?

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Blue Roof Music / High North Inc
PO Box 221  Grand Marais, MI  49839
phone: +1-906-494-2434
email: [email-masked]

> From: David B Harrington [mailto:[email-masked]]
> Sent: Saturday, October 29, 2005 3:38 PM
> To: 'McDonald, Ira'; 'Kaushik Narayan (kaushik)'; 'Nelson, David';
> [email-masked]; [email-masked]
> Subject: RE: [Isms] RE: Radext attributes
> 
> 
> Hi,
> 
> So does SSHSM:
> 
> " In order to allow SNMP traffic to be easily identified and filtered
>    by firewalls and other network devices, servers associated with
> SNMP
>    entities using the Secure Shell Security Model MUST default to
>    providing access to the "SNMP" SSH subsystem only when the SSH
>    session is established using the IANA-assigned TCP port (TBD).
>    Servers SHOULD be configurable to allow access to the SNMP SSH
>    subsystem over other ports." 
> 
> That wasn't the question, though. 
> 
> The question was how to communicate a service name from SSHSM to
> RADIUS via SSH.
> 
> David Harrington
> [email-masked]
> 
> > From: [email-masked] 
> > [mailto:[email-masked]] On Behalf Of McDonald, Ira
> > Sent: Saturday, October 29, 2005 3:30 PM
> > To: 'Kaushik Narayan (kaushik)'; Nelson, David; 
> > [email-masked]; [email-masked]
> > Subject: [Isms] SNMP over SSH REQUIRES a separate port
> > 
> > > From: [email-masked] 
> > > [mailto:[email-masked]]On
> > > Behalf Of Kaushik Narayan (kaushik)
> > > Sent: Friday, October 28, 2005 6:14 PM
> > > To: Nelson, David; [email-masked]; [email-masked]
> > > Subject: RE: [Isms] RE: Radext attributes
> > >
> > > ...snip... 
> > > 
> > I note that the IETF Netconf over SSH current draft REQUIRES 
> > a separate
> > port:
> > 
> >     "In order to allow NETCONF traffic to be easily identified and
> >     filtered by firewalls and other network devices, NETCONF 
> > servers MUST
> >     default to providing access to the "netconf" SSH 
> > subsystem only when
> >     the SSH session is established using the IANA-assigned TCP port
> >     <TBD>.  Servers SHOULD be configurable to allow access to 
> > the netconf
> >     SSH subsystem over other ports."
> > 
> > Based on current IETF best practice, I assume the same applies to
> SNMP
> > over SSH.
> > 
> > Cheers,
> > - Ira
> > 
> > 
> > Ira McDonald (Musician / Software Architect)
> > Blue Roof Music / High North Inc
> > PO Box 221  Grand Marais, MI  49839
> > phone: +1-906-494-2434
> > email: [email-masked]
> >

---

From: "Kaushik Narayan \(kaushik\)" <[email-masked]>
Date: Sat, 29 Oct 2005 19:59:17 -0700

Hi David,

Since the SSH server for SSHSM will be running on a separate port, we
could have the SSH server specify the RADIUS service-name since there is
only service (snmp) in question.

Regards,
 kaushik!

-----Original Message-----
From: David B Harrington [mailto:[email-masked]] 
Sent: Saturday, October 29, 2005 12:38 PM
To: 'McDonald, Ira'; Kaushik Narayan (kaushik); 'Nelson, David';

Hi,

So does SSHSM:

   by firewalls and other network devices, servers associated with SNMP

The question was how to communicate a service name from SSHSM to RADIUS
via SSH.

David Harrington
[email-masked]

> I note that the IETF Netconf over SSH current draft REQUIRES a 
> separate
> port:
> 
>     filtered by firewalls and other network devices, NETCONF servers 
> MUST
>     default to providing access to the "netconf" SSH subsystem only 
> when
>     <TBD>.  Servers SHOULD be configurable to allow access to the 
> netconf
SNMP
> over SSH.
> 
> Cheers,
> - Ira
> 
> 
> Ira McDonald (Musician / Software Architect) Blue Roof Music / High 
> North Inc PO Box 221  Grand Marais, MI  49839
> phone: +1-906-494-2434

---

From: "Kaushik Narayan \(kaushik\)" <[email-masked]>
Date: Mon, 31 Oct 2005 08:18:10 -0800

Hi David,

You mentioned that "SSHSM could directly call the RADIUS Client itself,
after the SSH session has been established"

I wasn't sure of this assessment since SSHSM might not be involved
during SSH session establishment and it might not be possible to have
the SSHSM call the RADIUS client.

I was suggesting that since we have a separate port for SSHSM, the SSH
server can always call the RADIUS client with service=snmp.

Regards,
  kaushik!

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Nelson, David
Sent: Monday, October 31, 2005 7:12 AM
To: [email-masked]
Subject: RE: [Isms] RE: Radext attributes

Kaushik Narayan writes...
 
> authentication (RADIUS Access_Request) needs to happen prior to the
SSH

Why?  I'm not suggesting that authentication SHOULD occur after SSH
session establishment, I'm merely suggestion that I don't see that it
MUST occur before.  Could you please elaborate?

---

From: "Nelson, David" <[email-masked]>
Date: Mon, 31 Oct 2005 11:32:51 -0500

> during SSH session establishment ...

Correct.  It might not.

> ... and it might not be possible to have

I don't see why not?  Both exist on the managed entity.  This is simply
a matter of the necessary API.
 
> server can always call the RADIUS client with service=snmp.

Agreed.  That may be a good thing to do, in any event.