Subject: RE: [Isms] Issues AQ1 - AQ4

From: "Salowey, Joe" <[email-masked]>
Date: Mon, 6 Feb 2006 18:03:09 -0800

> -----Original Message-----
> From: Juergen Schoenwaelder [mailto:[email-masked]] 
> Sent: Monday, February 06, 2006 4:56 PM
> To: Salowey, Joe
> Cc: [email-masked]
> Subject: Re: [Isms] Issues AQ1 - AQ4
> 
> On Mon, Feb 06, 2006 at 04:44:57PM -0800, Salowey, Joe wrote:
> 
> > I don't see why it should matter who acts as client and 
> server as long
> > as the entity has the credentials to act in that role.  I also think
> > Wes's notification scheme will work. 
> 
> [...]
> 
> The problem boils down to which secrets you have to provision where
> and this seems operationally to be an issue. SNMPv3/USM requires to
> provision user identities and associated keys on all managed boxes and
> the operator feedback on this approach was quite negative. Many boxes
> these days have an ssh host key and are capable to out-source ssh user
> password authentication to AAA servers. We like to reuse that as much
> as possible/feasible.
> 

[Joe] Yes, I agree. However it seems that we have the credentials to
establish mutually authenticated connections in SSH.  The problem is
mapping the authenticated identity to its authorizations. 

> /js
> 
> -- 
> Juergen Schoenwaelder		    International University Bremen
> <http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 
> 28725 Bremen, Germany
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Miao Fuyou <[email-masked]>
Date: Tue, 07 Feb 2006 10:40:05 +0800

When notification originator initiates a connection as SSH client , it is
authenticated by SSH authentication protocol with one of the three methods:
public key, password and host-based. It is not good to use password
authentication because username/password must be provisioned on managed
host. But, it is very possible to apply host-based authentication in this
case. Anyway the host already has host key when it works as command
responder/SSH server, does it make sense to reuse host key for host-based
authention? 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Salowey, Joe
Sent: Tuesday, February 07, 2006 10:03 AM
To: [email-masked]
Cc: [email-masked]
Subject: RE: [Isms] Issues AQ1 - AQ4

[Joe] Yes, I agree. However it seems that we have the credentials to
establish mutually authenticated connections in SSH.  The problem is mapping
the authenticated identity to its authorizations.

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 7 Feb 2006 09:01:54 +0100

> mapping the authenticated identity to its authorizations.

For authorization to work in the SNMP architecture, all we need is a
securityName. Typically, this is the authenticated identity or a
mapping of it (there were lengthy discussions in the past on this list
of the merrits and problems of mapping say an SSH user identity to a
role name which is then used as the SNMP securityName - you may want
to dig into the archives in case that is of interest).

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany