Subject: [Isms] SNMP over SSH REQUIRES a separate port

From: "McDonald, Ira" <[email-masked]>
Date: Sat, 29 Oct 2005 12:30:10 -0700

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]On
> Behalf Of Kaushik Narayan (kaushik)
> Sent: Friday, October 28, 2005 6:14 PM
> To: Nelson, David; [email-masked]; [email-masked]
> Subject: RE: [Isms] RE: Radext attributes
>
> ...snip... 
> 
> I am not sure there are means to communicate a service name in SSH and
> the only option might be run the SSH server on a separate port for
> SSHSM.

I note that the IETF Netconf over SSH current draft REQUIRES a separate
port:

    "In order to allow NETCONF traffic to be easily identified and
    filtered by firewalls and other network devices, NETCONF servers MUST
    default to providing access to the "netconf" SSH subsystem only when
    the SSH session is established using the IANA-assigned TCP port
    <TBD>.  Servers SHOULD be configurable to allow access to the netconf
    SSH subsystem over other ports."

Based on current IETF best practice, I assume the same applies to SNMP
over SSH.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Blue Roof Music / High North Inc
PO Box 221  Grand Marais, MI  49839
phone: +1-906-494-2434
email: [email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Sat, 29 Oct 2005 15:38:20 -0400

Hi,

So does SSHSM:

" In order to allow SNMP traffic to be easily identified and filtered
   by firewalls and other network devices, servers associated with
SNMP
   entities using the Secure Shell Security Model MUST default to
   providing access to the "SNMP" SSH subsystem only when the SSH
   session is established using the IANA-assigned TCP port (TBD).
   Servers SHOULD be configurable to allow access to the SNMP SSH
   subsystem over other ports." 

That wasn't the question, though. 

The question was how to communicate a service name from SSHSM to
RADIUS via SSH.

David Harrington
[email-masked]

> [mailto:[email-masked]] On Behalf Of McDonald, Ira
> Sent: Saturday, October 29, 2005 3:30 PM
> To: 'Kaushik Narayan (kaushik)'; Nelson, David; 
> [email-masked]; [email-masked]
> Subject: [Isms] SNMP over SSH REQUIRES a separate port
>

---

From: Eliot Lear <[email-masked]>
Date: Sun, 30 Oct 2005 01:13:00 +0200

> The question was how to communicate a service name from SSHSM to

Dave,

Because the authentication phase occurs prior to the invocation of the 
SSHSM subsystem there are only two ways to convey the other side's intent:

    1.  use of a separate port

    2.  use of a username that is only authorized for SSHSM

We inevitably run into namespace concerns with 2, mind you.

Eliot