Subject: RE: [Isms] #1: is it important to support anonymous user accessto SNMP?

From: "McDonald, Ira" <[email-masked]>
Date: Tue, 25 Oct 2005 15:07:40 -0700

Hi,

The example given for the utility of 'anonymous authentication'
(which term is not merely an oxymoron, but actual gibberish)
was printer discovery via SNMP in an enterprise network.

Speaking from ten years in the printing industry, I'd like to
point out that printer vendors intensely dislike the use of
SNMP as a printer discovery mechanism, because it invariably
angers the network support staff of large enterprise networks.

So print clients and printer monitors written by printer vendors
have for some years shipped with the SNMP printer discovery
feature DISABLED and typically warn the end user in two levels 
of 'are you sure?' dialog boxes before attempting it.

This is NOT a realistic or suitable scenario to justify support 
of this 'anonymous authentication' feature in ISMS.

Cheers,
- Ira (co-editor of Printer MIB v2)

Ira McDonald (Musician / Software Architect)
Blue Roof Music / High North Inc
PO Box 221  Grand Marais, MI  49839
phone: +1-906-494-2434
email: [email-masked]

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]On
> Behalf Of Fleischman, Eric
> Sent: Tuesday, October 25, 2005 3:35 PM
> To: Glen Zorn (gwz); Joseph Salowey (jsalowey); [email-masked];
> Blumenthal, Uri; [email-masked]
> Subject: RE: [Isms] #1: is it important to support anonymous user
> accesstoSNMP?
> 
> 
> Glen,
> 
> Since I've scribbled once, I may as well scribble again to 
> respectfully
> disagree with your posting:
> If one defines authentication to be "proving that an entity is who it
> claims to be", then authenticating an anonymous entity is 
> simply proving
> that the entity has no specific identity to that system. 
> 
> It is a separate issue as to whether anonymous authentication 
> is needed
> or not within ISMS. I originally thought that it anonymity was not
> desirable in network management (i.e., the perspective I surmise that
> you hold), but David Perkin's subsequent arguments convinced me that
> there is a potential need to support anonymous entities. It also is a
> separate issue as to how authorization should relate to 
> authentication.
> 
> --Eric
> 
> -----Original Message-----
> From: Glen Zorn (gwz) [mailto:[email-masked]] 
> 
> Fleischman, Eric <> supposedly scribbled:
> 
> > This discussion appears to me to have been coupling authentication 
> > with authorization. If we permit the authentication of an 
> "anonymous" 
> > entity, then the question of whether or not that entity is 
> authorized 
> > to do anything useful is a policy issue.
> 
> The term "authentication" doesn't seem to apply to anonymous entities.
> 
> Hope this helps,
> 
> ~gwz
> 
> W
> 
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/isms
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "McDonald, Ira" <[email-masked]>
Date: Sat, 29 Oct 2005 12:19:57 -0700

Hi Eric,

Thanks for the pointer to Joe Touch's ANONsec draft from May 2004.

I read it all the way through with interest.  And then I discovered 
the recently chartered IETF BTNS (Better Than Nothing Security) WG, 
(http://www.ietf.org/html.charters/btns-charter.html), which has
published:

  "Problem and Applicability Statement for Better Than Nothing Security
  (BTNS)", Joseph Touch, 26-Sep-05, <draft-ietf-btns-prob-and-applic-01.txt>

The two independent working drafts are:

  "An Unauthenticated, or Leap-of-Faith-Authorization Mode for
  Bump-In-The-Stack Implementations of IPsec Using Internet Key Exchange
  Protocols", Nicolas Williams, 2-May-05,
  <draft-williams-btns-unauthenticated-bits-00.txt>

  "Better-Than-Nothing-Security: An Unauthenticated Mode of IPsec", Nicolas
  Williams, 8-Sep-05, <draft-williams-btns-00.txt>

The latter is the successor to Joe Touch's original ANONsec draft.

But what Joe Touch and the BTNS folks have done is give a good rationale
for adding support for unauthenticated IKE SAs (Security Associations) to 
IKEv2.

That is, the whole point of Joe's argument is that this mechanism is ONLY
useful at the NETWORK layer - to protect against off-path attacks on the
transport protocols - such as the serious RST attack on TCP, which cannot
be defended against within TCP for long-duration connections at high data 
rates (above 100 Mbps), because the valid receive window simply becomes 
too large.

I'm unpersuaded that this is a good general mechanism at the application
layer (e.g., SNMP), even though it is ubiquitous in web browsing (HTTPS).

This is NOT an 'authenticated' mechanism.  When used at the application 
layer, it cannot defend against active off-path or man-in-the-middle
attacks.

I doubt that the reason we want networks to deploy SNMPv3 is the protocol
performance improvements over SNMPv1.  I think the main reason is to get
them to use acceptably strong security to avoid compromising the integrity
of their networks.

Anonymous use access to SNMP is available now with the SNMPv1 'public'
community.  And it's caused a lot of serious problems.

Cheers,
- Ira

> From: Fleischman, Eric [mailto:[email-masked]]
> Sent: Tuesday, October 25, 2005 6:32 PM
> To: McDonald, Ira; Glen Zorn (gwz); Joseph Salowey (jsalowey);
> [email-masked]; Blumenthal, Uri; [email-masked]; David T. Perkins
> Ira,
> Thank you for this insightful posting. Perhaps I was too 
> easily swayed,
> but the thoughts within David Perkin's postings that I resonated with
> are the following points (i.e., not the printing example that you
> cited):
> 1) David Perkins argument about the need for ""anonymous clients"
> retrieving info via an authenticated server via a channel 
> with integrity
> and possibly encryption"
> 2) Joe Touch's ideas about the need for a "minimalist" 
> security options
> (i.e., something between none and plenty) such as
> http://www.dfn-pca.de/bibliothek/standards/ietf/none/internet-
drafts/dra
ft-touch-anonsec-00.txt
3) My own Fear, Uncertainty, and Doubt (FUD) as I remembered how often I
have failed to think of important use cases in the past and a desire
therefore to avoid being painted into a corner in the future by my own
lack of foresight.

Do any of these points resonate with you?

--Eric