Subject: [Isms] Issues AQ1 - AQ4

From: "Salowey, Joe" <[email-masked]>
Date: Mon, 6 Feb 2006 16:44:57 -0800

I don't see why it should matter who acts as client and server as long
as the entity has the credentials to act in that role.  I also think
Wes's notification scheme will work. 

It seems that this really involves authorization.  After SSH completes
each side has authenticated the party at the other end of the
conversation.  An entity should be able to determine from the
authenticated identity of its peer what it is authorized to send to the
peer and what the peer is authorized to send to it.  Whether the
authenticated identity is a host or a user should not matter in most
cases.  As long as you have entries in your authorization system for
your peer you can determine what the set of authorized interactions are.
Where you may have issues is if there are multiple engines running with
different authorizations on a host acting as an SSH server, but I think
this is a corner case.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 7 Feb 2006 01:56:09 +0100

> Wes's notification scheme will work. 

[...]

The problem boils down to which secrets you have to provision where
and this seems operationally to be an issue. SNMPv3/USM requires to
provision user identities and associated keys on all managed boxes and
the operator feedback on this approach was quite negative. Many boxes
these days have an ssh host key and are capable to out-source ssh user
password authentication to AAA servers. We like to reuse that as much
as possible/feasible.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Sun, 12 Feb 2006 22:31:21 -0500 (EST)

[ Sorry I've been silent for a while.  This list seems to alternate
between getting no traffic and getting traffic I don't see because my
mailer isn't checking the mailbox for some reason. :-( ]

> Wes's notification scheme will work.

So do I.

I will note that NG->NR connections should not be on a fixed port
allocated by IANA, but on a port specified when the notification is
requested (perhaps with an IANA-assigned default/recommended port).

This allows more than one user to run a management station on the same IP
host.

-- Jeff