Subject: [Isms] ISMS Interim summary by dbh

From: "David B Harrington" <[email-masked]>
Date: Thu, 16 Feb 2006 10:52:40 -0500

Hi,

Here is my quick summary of the ISMS interim, for those interested.
In general, it was an educational and brainstorming exercise rather
than directed problem-solving.
The chairs will presumably post the official summary and the minutes
and the action items.

We didn't provide any jabber capability, beyond naming a chat room,
but we never picked a jabber scribe.

Day One:
The agenda called for four 10/15 minute intros to our areas of
expertise. We spent about five hours doing the intros and answering
questions related to the intros. 

The afternoon session was primarily about the RADIUS integration and
what we needed to include in our request to RADEXT. The group favored
an "authorization-only" extension to RADIUS, so authentication can be
done using non-RADIUS means, such as Kerberos, and RADIUS can then be
consulted for authorization purposes (with the conversation between
the RADIUS client and server being something along the lines of
"You've authenticated us as the RADIUS client; we've already had this
user authenticated; trust us when we assert that he is authenticated.
Now just tell us what he can do.").

In addition, the group discussed making AAA integration an optional
optimization that is used to populate access-control-model tables, in
an implementation-dependent manner. This basically addresses issue
RQ1. The WG should develop a document that describes such an
optimization, using an example of VACM and an authorize-only RADIUS
feature to populate the VACM userToGroup table. 

Day Two:
As part of my intro to SNMPv3, I prepared easel pad drawings of the
architecture (the block diagrams from 3411) and the scenario diagrams
(also directly from rfc 3411) and parameter data flows, and hung these
on the walls of the conference room. The parameter dat flows were
represented as a spreadsheet of the ASIs and the parameters, which
made it fairly easy to understand the data flows of the system. I plan
to post this to the WG in a spreadsheet format.

Most of the second day was spent walking through the ASI/data flows
for command generation/response handling and we started on
notiification origination/receipt data flows. This exercise helped to
understand what information had to be available when, and, as we tried
to determine how to pass data from SSH to SNMP or vice-versa, and what
needs to be saved in the tmStateReference cache, and it also helped to
bring out some differences in the semantics of terminology (principal,
securityName, securityEngineID, etc.).

During the afternoon, David Perkins and Wes had a list of specific
things they wanted addressed, so we discussed those issues.

Regarding other agenda items:
We did not "confirm solutions" since we did that at IETF64.

We need WG review of the SSHSM -01- document to confirm the solutions
discussed at IETF64 and documented in -01-.

We did not discuss session establishment and teardown, except
incidentally.
We discussed notifications to a degree during the walkthroughs, and in
DavidP's concerns, but did not have enough time to finish the
walkthrough, so really never had that discussion fully.
We did not get into callback to any significant degree.

David Harrington
[email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms