From isms-bounces@lists.ietf.org Wed Apr 12 11:06:57 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1FTgvp-0007TJ-0x; Wed, 12 Apr 2006 11:06:57 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1FTgvn-0007T4-L5 for isms@ietf.org; Wed, 12 Apr 2006 11:06:55 -0400 Received: from stsc1260-eth-s1-s1p1-vip.va.neustar.com ([156.154.16.129] helo=chiedprmail1.ietf.org) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1FTgQC-0007oT-7T for isms@ietf.org; Wed, 12 Apr 2006 10:34:16 -0400 Received: from ns1.cpanel.btnaccess.com ([205.177.121.2]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1FTgCS-0003H1-UI for isms@ietf.org; Wed, 12 Apr 2006 10:20:08 -0400 Received: from [65.213.193.6] (helo=ISODELL001) by ns1.cpanel.btnaccess.com with esmtp (Exim 4.52) id 1FTgCR-0007ia-Ka for isms@ietf.org; Wed, 12 Apr 2006 10:20:03 -0400 From: "Robert Holliday" To: Date: Wed, 12 Apr 2006 10:19:59 -0400 MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook, Build 11.0.5510 Thread-Index: AcZePC4BJQeaWno6Rz6l7OdqxzI2sw== X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - ns1.cpanel.btnaccess.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12] X-AntiAbuse: Sender Address Domain - isocore.com X-Source: X-Source-Args: X-Source-Dir: X-Spam-Score: 0.1 (/) X-Scan-Signature: f6f6dea784da824ef7de6e94f86a2322 Cc: Subject: [Isms] On-line Registration Closing Sunday X-BeenThere: isms@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0282646938==" Errors-To: isms-bounces@lists.ietf.org Message-Id: This is a multi-part message in MIME format. --===============0282646938== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0004_01C65E1A.A7268D00" This is a multi-part message in MIME format. ------=_NextPart_000_0004_01C65E1A.A7268D00 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit This week is the last chance for attendees to register online for the International Conference on Network Security. For those interested in registering before time runs out please go to: www.networksecurity2006.com Conference Program Monday, April 17 TECHNICAL SESSIONS AND PANELS 8:45 - 10:30 am Opening Session Chair: Guy Copeland VP and Assistant to the President, CSC . Introduction Guy Copeland . Keynote Speech Andy Purdy Department of Homeland Security . Issues in Wiretapping Technologies Matt Blaze University of Pennsylvania Break (10:30 - 10:45 am) 10:45 am - 12:30 pm Panel: User Authentication Technologies Chair: Radia Perlman Sun Microsystems . PKI: It's not that hard. Why don't we have it? Charlie Kaufman Microsoft . Web Services/Liberty Approach to Single Sign-on Gerald Beuchelt Sun Microsystems . Is the Identity-based Crypto the Best Solution? Terence Spies Voltage Security . PKI: Let's Make it Happen! Bill Burr NIST . SAML Comparison to Kerberos to Support a Centralized Authoritative Source for Authentication Hank Simon Lockheed Martin Lunch (12:30 - 1:45 pm) 1:45 - 3:00 pm Mesh Network Security Chair: Russ Housley Vigil Security, LLC . Status of 802.11 Mesh and Security Donald Eastlake III Motorola . Security Issues in 802.11s William Arbaugh, UMD Jesse Walker, Intel . More on 802.11s Robert Moskowitz ICSA Labs, Cybertrust Break (3:00 - 3:15 pm) 3:15 - 4:30 pm Defending Against Denial of Service Chair: Jim Hughes Sun Microsystems . Surviving Denial of Service Andy Ellis Akamai . MITHRIL: Adaptable Security for Survivability in Collaborative Computing Sites Von Welch, NCSA Jim Basney, NCSA Himanshu Khurana, NCSA . Investigating the Impact of Real-World Factors on Internet Worm Propagation Xiaoyan Hong University of Alabama 4:30 - 5:30 pm Panel: Legislative Aspects of Security . Pat Schambach Nortel . Robert Dix Jr. Citadel Security Software . Michael Aisenberg Verisign . John Morris Center for Democracy & Technology 5:30 - 6:30 pm Reception 6:45 - 7:45 pm Tutorial: Network Incident Response Presenter: Richard Bejtlich Tao Security Tuesday, April 18 TECHNICAL SESSIONS AND PANELS 9:00 - 10:30 am Software Security Chair: Charlie Kaufman Microsoft . Why Software Breaks Andrew Lee Eset . Federal Standards and Guidelines Developed by NIST Stuart Katzke NIST . Impact of NSTISSP-11 on the Current Certification Climate for Products and Technology Keith Beatty SAIC . How can we make products and deployments more secure? Eric Cole Lockheed Martin Break (10:30 - 10:45 am) 10:45 am - 12:30 pm Network Security Protocol Issues Chair: Hilarie Orman Purple Streak, Inc. . Introduction and Comparison of IPv4 Address Resolution Protocol, ICMP Router Discovery and ICMP Redirect; and IPv6 Neighbor Discovery Protocol Security Issues Michael Wasielewski Lockheed-Martin . The ability for the Warfighter to share critical information across and between networks without leakage Adele Friedel Tenix America . Availability and Security Tradeoffs Arun Sood Task Technologies Ltd. . Firewall Traversal: Security and Scalability David McGrew Cisco Systems . Updates on IETF Security Related Working Groups Sam Hartman MIT Russ Housley Vigil Security Lunch (12:30 - 1:45 pm) 1:45 - 3:00 pm Security for Wireless and Internet Mobility Chair: Bijan Jabbari Isocore . Optimizations to Support Secure AP Transitions in 802.11 WLANs Jesse Walker Intel . 3GPP2 Network Firewall Configuration and Control Michael Paddon Qualcomm . Proactive EAP-based handover key management for mobile wireless users Madjid Nakhjiri Motorola Break (3:00 - 3:15 pm) 3:15 - 4:30 pm Panel: Internet Infrastructure Security Chair: Hilarie Orman Purple Streak, Inc. . MPLS VPN Security Harmen van der Linde Cisco Systems . DHS and Internet Infrastructure Security Marcus Sachs SRI . Routing Security Sandra Murphy Sparta . Why Routing Protocol Security isn't Seeing Wide Adoption Russ White Cisco Systems 4:30 - 5:30 pm Web Browser Security Moderator: Darren Moffat Sun Microsystems . The Sad State of Evolution of Interface to User Security with a Focus on the Web Browser Eric Greenberg Netframeworks . XML: Salvation or Struggle Donald Eastlake III Motorola . Web Browser Security Frameworks Perry Metzger Piermont . Issues in Web Browser Security Sam Hartman MIT Wednesday, April 19 TECHNICAL SESSIONS AND PANELS 9:00 - 10:30 am DNS Security Chair: Donald Eastlake III Motorola . Why isn't DNS security deployed, and would we be safer if it was? Charlie Kaufman Microsoft . DNSSEC and FISMA Scott Rose NIST . DNS Security Stuart Schechter Lincoln Laboratory . The Registry Perspective on DNSSEC Matt Larson Verisgn Break (10:30 - 10:45 am) 10:45 am - 12:30 pm Panel: Trusted Platforms Chair: Radia Perlman Sun Microsystems . Trusted Computing: Towards Safe Computing Environments Tom Hardjono SignaCert . A use for TPM Technology in Routing Infrastructure Andy Ellis Akamai . Issues in TPM Technology Ned Smith Intel . An Outsider's Perspective on TPM Russ Housley Vigilsec ------=_NextPart_000_0004_01C65E1A.A7268D00 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

 

This week is the last chance for attendees to = register online for the International Conference on Network Security.  For = those interested in registering before time runs out please go to:  www.networksecurity2006.com<= /a>

 

Conference Program =

 

Monday, April 17

TECHNICAL SESSIONS AND PANELS 

 

8:45 - 10:30 am

Opening Session

Chair: Guy Copeland

VP and Assistant to the President, = CSC

 

· Introduction

Guy Copeland

 

· Keynote Speech

Andy Purdy

Department of Homeland Security

 

· Issues in Wiretapping Technologies =

Matt Blaze

University of = Pennsylvania

 

Break (10:30 – 10:45 am)

 

10:45 am - 12:30 pm

Panel: User Authentication = Technologies

Chair: Radia Perlman

Sun Microsystems

 

· PKI: It's not that hard. Why don't we have = it?

Charlie Kaufman

Microsoft

 

· Web Services/Liberty Approach to Single = Sign-on

Gerald Beuchelt

Sun Microsystems

 

· Is the Identity-based Crypto the Best = Solution?

Terence Spies

Voltage Security

 

· PKI: Let’s Make it Happen! =

Bill Burr

NIST

 

· SAML Comparison to Kerberos to Support a = Centralized Authoritative Source for Authentication

Hank Simon

Lockheed Martin

 

Lunch (12:30 – 1:45 pm)

 

1:45 - 3:00 pm

Mesh Network Security

Chair: Russ Housley

Vigil Security, LLC

 

· Status of 802.11 Mesh and Security =

Donald Eastlake III

Motorola

 

· Security Issues in 802.11s =

William Arbaugh, UMD

Jesse Walker, Intel

 

· More on 802.11s

Robert Moskowitz

ICSA Labs, Cybertrust

 

Break (3:00 – 3:15 pm)

 

3:15 - 4:30 pm

Defending Against Denial of Service =

Chair: Jim Hughes

Sun Microsystems

 

· Surviving Denial of = Service

Andy Ellis

Akamai

 

· MITHRIL: Adaptable Security for = Survivability in Collaborative Computing Sites

Von Welch, NCSA

Jim Basney, NCSA

Himanshu Khurana, NCSA

 

· Investigating the Impact of Real-World = Factors on Internet Worm Propagation

Xiaoyan Hong

University of = Alabama

 

4:30 - 5:30 pm

Panel: Legislative Aspects of Security =

 

· Pat Schambach

Nortel

 

· Robert Dix Jr.

Citadel Security Software

 

· Michael Aisenberg

Verisign

 

· John Morris

Center for Democracy & = Technology

 

5:30 - 6:30 pm

Reception

 

6:45 - 7:45 pm

Tutorial: Network Incident Response =

Presenter: Richard Bejtlich

Tao Security

 

Tuesday, April 18

TECHNICAL SESSIONS AND PANELS

 

9:00 - 10:30 am

Software Security

Chair: Charlie Kaufman

Microsoft

 

· Why Software Breaks

Andrew Lee

Eset

 

· Federal Standards and = Guidelines

Developed by NIST

Stuart Katzke

NIST

 

· Impact of NSTISSP-11 on the = Current

Certification Climate for Products and =

Technology

Keith Beatty

SAIC

 

· How can we make products = and

deployments more secure?

Eric Cole

Lockheed Martin

 

Break (10:30 – 10:45 am)

 

10:45 am - 12:30 pm

Network Security Protocol Issues

Chair: Hilarie Orman

Purple Streak, Inc.

 

· Introduction and Comparison of IPv4 Address = Resolution Protocol, ICMP Router Discovery and ICMP Redirect; and IPv6 Neighbor = Discovery Protocol Security Issues

Michael Wasielewski

Lockheed-Martin

 

· The ability for the Warfighter to share = critical information across and between networks without leakage

Adele Friedel

Tenix America

 

· Availability and Security Tradeoffs =

Arun Sood

Task Technologies Ltd.

 

· Firewall Traversal: Security and = Scalability

David McGrew

Cisco Systems

 

· Updates on IETF Security Related Working = Groups

Sam Hartman

MIT

Russ Housley

Vigil Security

 

Lunch (12:30 – 1:45 pm)

 

1:45 - 3:00 pm

Security for Wireless and Internet = Mobility

Chair: Bijan Jabbari

Isocore

 

· Optimizations to Support Secure AP = Transitions in 802.11 WLANs

Jesse Walker

Intel

 

· 3GPP2 Network Firewall Configuration and = Control

Michael Paddon

Qualcomm

 

· Proactive EAP-based handover key management = for mobile wireless users

Madjid Nakhjiri

Motorola

 

Break (3:00 – 3:15 pm)

 

3:15 - 4:30 pm

Panel: Internet Infrastructure = Security

Chair: Hilarie Orman

Purple Streak, Inc.

 

· MPLS VPN Security

Harmen van der Linde

Cisco Systems

 

· DHS and Internet Infrastructure = Security

Marcus Sachs

SRI

 

· Routing Security

Sandra Murphy

Sparta

 

· Why Routing Protocol Security isn't Seeing = Wide Adoption

Russ White

Cisco Systems

 

4:30 - 5:30 pm

Web Browser Security

Moderator: Darren Moffat

Sun Microsystems

 

· The Sad State of Evolution of Interface to = User Security with a Focus on the Web Browser

Eric Greenberg

Netframeworks

 

· XML: Salvation or Struggle

Donald Eastlake III

Motorola

 

· Web Browser Security Frameworks =

Perry Metzger

Piermont

 

· Issues in Web Browser = Security

Sam Hartman

MIT

 

Wednesday, April 19

TECHNICAL SESSIONS AND PANELS

 

9:00 - 10:30 am

DNS Security

Chair: Donald Eastlake III

Motorola

 

· Why isn't DNS security deployed, and would = we be safer if it was?

Charlie Kaufman

Microsoft

 

· DNSSEC and FISMA

Scott Rose

NIST

 

· DNS Security

Stuart Schechter

Lincoln Laboratory =

 

· The Registry Perspective on = DNSSEC

Matt Larson

Verisgn

 

Break (10:30 – 10:45 am)

 

10:45 am - 12:30 pm

Panel: Trusted Platforms

Chair: Radia Perlman

Sun Microsystems

 

· Trusted Computing: Towards Safe Computing = Environments

Tom Hardjono

SignaCert

 

· A use for TPM Technology in Routing = Infrastructure

Andy Ellis

Akamai

 

· Issues in TPM Technology

Ned Smith

Intel

 

· An Outsider’s Perspective on = TPM

Russ Housley

Vigilsec

 

 

 

 

 

 

 

------=_NextPart_000_0004_01C65E1A.A7268D00-- --===============0282646938== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Isms mailing list Isms@lists.ietf.org https://www1.ietf.org/mailman/listinfo/isms --===============0282646938==-- From isms-bounces@lists.ietf.org Fri Apr 21 15:49:14 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1FX1cr-0006qc-Va; Fri, 21 Apr 2006 15:49:09 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1FX1cq-0006qU-OV for isms@ietf.org; Fri, 21 Apr 2006 15:49:08 -0400 Received: from kyoto.netlab.nec.de ([195.37.70.21]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1FX1cp-0002ls-E3 for isms@ietf.org; Fri, 21 Apr 2006 15:49:08 -0400 Received: from [192.168.1.128] (HSI-KBW-085-216-002-068.hsi.kabelbw.de [85.216.2.68]) by kyoto.netlab.nec.de (Postfix) with ESMTP id B3BB41BAC4D for ; Fri, 21 Apr 2006 21:44:23 +0200 (CEST) Date: Fri, 21 Apr 2006 21:49:07 +0200 From: Juergen Quittek To: isms@ietf.org Message-ID: <5096F23BA60CC51A4741CF0C@[192.168.1.128]> X-Mailer: Mulberry/3.1.6 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Cc: Subject: [Isms] minutes of our session in Dallas X-BeenThere: isms@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: isms-bounces@lists.ietf.org Dear all, Please find the draft minutes of our session in Dallas at . If you have suggestions for changes, please send them within the next two weeks until Friday, May 5. If you want to get more details about our discussions, you will find the audio recording of the session at Thanks, Juergen -- Juergen Quittek quittek@netlab.nec.de Tel: +49 6221 90511-15 NEC Europe Ltd., Network Laboratories Fax: +49 6221 90511-55 Kurfuersten-Anlage 36, 69115 Heidelberg, Germany http://www.netlab.nec.de _______________________________________________ Isms mailing list Isms@lists.ietf.org https://www1.ietf.org/mailman/listinfo/isms From isms-bounces@lists.ietf.org Tue Apr 25 10:07:26 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1FYOCM-0000Pg-4k; Tue, 25 Apr 2006 10:07:26 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1FYO29-0007ky-Ch for isms@ietf.org; Tue, 25 Apr 2006 09:56:53 -0400 Received: from hermes.iu-bremen.de ([212.201.44.23]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1FYNtq-00012X-IG for isms@ietf.org; Tue, 25 Apr 2006 09:48:19 -0400 Received: from localhost (demetrius.iu-bremen.de [212.201.44.32]) by hermes.iu-bremen.de (Postfix) with ESMTP id 84CD355C16 for ; Tue, 25 Apr 2006 15:48:17 +0200 (CEST) Received: from hermes.iu-bremen.de ([212.201.44.23]) by localhost (demetrius [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id 19745-06; Tue, 25 Apr 2006 15:48:15 +0200 (CEST) Received: from boskop.local (unknown [10.50.250.214]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.iu-bremen.de (Postfix) with ESMTP id 9F426E981; Tue, 25 Apr 2006 15:48:15 +0200 (CEST) Received: by boskop.local (Postfix, from userid 501) id 1B99B6BF8F7; Tue, 25 Apr 2006 15:48:14 +0200 (CEST) Date: Tue, 25 Apr 2006 15:48:14 +0200 From: Juergen Schoenwaelder To: isms@ietf.org Message-ID: <20060425134814.GC9531@boskop.local> Mail-Followup-To: isms@ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.10i X-Virus-Scanned: by amavisd-new 20030616p5 at demetrius.iu-bremen.de X-Spam-Score: 0.0 (/) X-Scan-Signature: 82c9bddb247d9ba4471160a9a865a5f3 Cc: Subject: [Isms] isms prototyping status X-BeenThere: isms@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: j.schoenwaelder@iu-bremen.de List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: isms-bounces@lists.ietf.org Hi, this list is pretty silent and hence I though I report a bit about the current status of our work at IUB to prototype SNMP over SSH. We now have some running SNMP over SSH code - far from being complete but good enough to make some measurements in order to figure out what the overhead is. I believe this is a major concern shared by many people and I like to provide some concrete numbers soon. We have basically written an SSH transport mapping for NETSNMP using libssh (and SSH C library implementation) and right now we kind of run SNMPv1/SNMPv2c over it (probably not terrible useful, but simple to get running). We map the SSH user name to the security name and bypass the community-based security model, basically ignoring the community name for any authentication purposes. The SSH transport on the server side currently only supports password authentication. However, we have hooked password authentication to the PAM API which allows to use local accounts or RADIUS or LDAP or ... just by appropriate PAM configuration. This is nice. We started coding the secruity model portion of SSHSM but that might take some more time to get running since we want to focus on some measurements first. My first usage experience of all this is great: snmpwalk -v 2c -c ignored ssh:example.org 1.3.6 is all you have to type, if you want to request an explicit user name you type snmpwalk -v 2c -c ignored ssh:fred@example.org 1.3.6 and that is it. Performance concerns me a bit - but we have to understand more closely where the delays we are seeing are coming from and whether something can be done about it. Things obviously look much better once the message sizes increase; getbulk is really your friend here. The SNMP measurements we are doing in production networks so far however do not suggest that the actual usage of getbulk out there is overwhelming - but this is just an early observation; once we have more traces we will have a clearer picture and perhaps we can then even report that management applications are actually smarter than they look right now. Once we have some more data (in say two weeks since one student involved in the measurements has a hard deadline ;-), I will post a more detailed report to the list and make the code available for general consumption. /js -- Juergen Schoenwaelder International University Bremen P.O. Box 750 561, 28725 Bremen, Germany _______________________________________________ Isms mailing list Isms@lists.ietf.org https://www1.ietf.org/mailman/listinfo/isms From isms-bounces@lists.ietf.org Tue Apr 25 14:31:40 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1FYSK4-0003P0-HX; Tue, 25 Apr 2006 14:31:40 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1FYSK3-0003Ou-Tj for isms@ietf.org; Tue, 25 Apr 2006 14:31:39 -0400 Received: from dcn236-43.dcn.davis.ca.us ([168.150.236.43] helo=wes.hardakers.net) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1FYSK2-0007gI-KM for isms@ietf.org; Tue, 25 Apr 2006 14:31:39 -0400 Received: by wes.hardakers.net (Postfix, from userid 274) id 123AD11D5F8; Tue, 25 Apr 2006 11:31:37 -0700 (PDT) From: Wes Hardaker To: isms@ietf.org Subject: Re: [Isms] isms prototyping status Organization: Sparta References: <20060425134814.GC9531@boskop.local> Date: Tue, 25 Apr 2006 11:31:36 -0700 In-Reply-To: <20060425134814.GC9531@boskop.local> (Juergen Schoenwaelder's message of "Tue, 25 Apr 2006 15:48:14 +0200") Message-ID: User-Agent: Gnus/5.110004 (No Gnus v0.4) XEmacs/21.4.19 (linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Spam-Score: 0.1 (/) X-Scan-Signature: 798b2e660f1819ae38035ac1d8d5e3ab Cc: X-BeenThere: isms@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: isms-bounces@lists.ietf.org >>>>> On Tue, 25 Apr 2006 15:48:14 +0200, Juergen Schoenwaelder said: Juergen> We have basically written an SSH transport mapping for Juergen> NETSNMP using libssh (and SSH C library implementation) and Juergen> right now we kind of run SNMPv1/SNMPv2c over it (probably not Juergen> terrible useful, but simple to get running). We map the SSH Juergen> user name to the security name and bypass the community-based Juergen> security model, basically ignoring the community name for any Juergen> authentication purposes. That's not quite the best way to do things, by the way... I'd be happy to provide guidance on the better way to do things that will actually allow a SNMPv3 packet with a SSH security model to be used instead... Functionally that's what I implemented a while back but over stdin/out instead of using a ssh library. -- Wes Hardaker Sparta, Inc. _______________________________________________ Isms mailing list Isms@lists.ietf.org https://www1.ietf.org/mailman/listinfo/isms From isms-bounces@lists.ietf.org Tue Apr 25 16:38:55 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1FYUJ8-000407-TG; Tue, 25 Apr 2006 16:38:50 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1FYUJ8-000402-4u for isms@ietf.org; Tue, 25 Apr 2006 16:38:50 -0400 Received: from hermes.iu-bremen.de ([212.201.44.23]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1FYUJ5-0006lV-Bx for isms@ietf.org; Tue, 25 Apr 2006 16:38:50 -0400 Received: from localhost (demetrius.iu-bremen.de [212.201.44.32]) by hermes.iu-bremen.de (Postfix) with ESMTP id B387655E92; Tue, 25 Apr 2006 22:38:37 +0200 (CEST) Received: from hermes.iu-bremen.de ([212.201.44.23]) by localhost (demetrius [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id 28698-05; Tue, 25 Apr 2006 22:38:35 +0200 (CEST) Received: from boskop.local (unknown [10.222.1.4]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.iu-bremen.de (Postfix) with ESMTP id BBEE255E74; Tue, 25 Apr 2006 22:38:35 +0200 (CEST) Received: by boskop.local (Postfix, from userid 501) id 166DC6BFFD5; Tue, 25 Apr 2006 22:38:34 +0200 (CEST) Date: Tue, 25 Apr 2006 22:38:34 +0200 From: Juergen Schoenwaelder To: Wes Hardaker Subject: Re: [Isms] isms prototyping status Message-ID: <20060425203834.GD10877@boskop.local> Mail-Followup-To: Wes Hardaker , isms@ietf.org References: <20060425134814.GC9531@boskop.local> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.10i X-Virus-Scanned: by amavisd-new 20030616p5 at demetrius.iu-bremen.de X-Spam-Score: 0.0 (/) X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17 Cc: isms@ietf.org X-BeenThere: isms@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: j.schoenwaelder@iu-bremen.de List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: isms-bounces@lists.ietf.org On Tue, Apr 25, 2006 at 11:31:36AM -0700, Wes Hardaker wrote: > >>>>> On Tue, 25 Apr 2006 15:48:14 +0200, Juergen Schoenwaelder said: > > Juergen> We have basically written an SSH transport mapping for > Juergen> NETSNMP using libssh (and SSH C library implementation) and > Juergen> right now we kind of run SNMPv1/SNMPv2c over it (probably not > Juergen> terrible useful, but simple to get running). We map the SSH > Juergen> user name to the security name and bypass the community-based > Juergen> security model, basically ignoring the community name for any > Juergen> authentication purposes. > > > > That's not quite the best way to do things, by the way... I'd be > happy to provide guidance on the better way to do things that will > actually allow a SNMPv3 packet with a SSH security model to be used > instead... Functionally that's what I implemented a while back but > over stdin/out instead of using a ssh library. > > I did not say it is the best way to do things - in thing I wrote "probably not terrible useful, but simple to get running". I am aware of the "localsm" security model you may be referring to and we are looking at clone it as a starting point for the security model portion of the SSHSM. Concrete insights on how this all works from people who know this code base better than we do are of course always welcome... /js https://subversion.eecs.iu-bremen.de/svn/schoenw/src/net-snmp-5.3.0.1/ -- Juergen Schoenwaelder International University Bremen P.O. Box 750 561, 28725 Bremen, Germany _______________________________________________ Isms mailing list Isms@lists.ietf.org https://www1.ietf.org/mailman/listinfo/isms From isms-bounces@lists.ietf.org Tue Apr 25 17:39:28 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1FYVFk-0001JO-7E; Tue, 25 Apr 2006 17:39:24 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1FYVFi-0001JD-NN for isms@ietf.org; Tue, 25 Apr 2006 17:39:22 -0400 Received: from pop-savannah.atl.sa.earthlink.net ([207.69.195.69]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1FYVFh-0001xz-Gv for isms@ietf.org; Tue, 25 Apr 2006 17:39:22 -0400 Received: from h-68-166-38-214.snvacaid.dynamic.covad.net ([68.166.38.214] helo=oemcomputer) by pop-savannah.atl.sa.earthlink.net with smtp (Exim 3.36 #10) id 1FYVFb-000225-00 for isms@ietf.org; Tue, 25 Apr 2006 17:39:16 -0400 Message-ID: <001401c668b1$4a487340$6501a8c0@oemcomputer> From: "Randy Presuhn" To: References: <20060425134814.GC9531@boskop.local> Subject: Re: [Isms] isms prototyping status Date: Tue, 25 Apr 2006 14:43:28 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1478 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1478 X-Spam-Score: 0.0 (/) X-Scan-Signature: d6b246023072368de71562c0ab503126 Cc: X-BeenThere: isms@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: isms-bounces@lists.ietf.org Hi - > From: "Juergen Schoenwaelder" > To: > Sent: Tuesday, April 25, 2006 6:48 AM > Subject: [Isms] isms prototyping status ... > and that is it. Performance concerns me a bit - but we have to > understand more closely where the delays we are seeing are coming from > and whether something can be done about it. Things obviously look much ... Two things that I've seen with some SMUX and AgentX implementations that might be at work here to negatively impact performance are interactions with the Nagel algorithm and with TCP slowstart. Using the NONAGEL ioctl or its equivalent, if you're not already doing so, might make a difference. Randy _______________________________________________ Isms mailing list Isms@lists.ietf.org https://www1.ietf.org/mailman/listinfo/isms From isms-bounces@lists.ietf.org Wed Apr 26 06:31:25 2006 Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1FYhIr-0000It-EG; Wed, 26 Apr 2006 06:31:25 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1FYhIq-0000Io-Ez for isms@ietf.org; Wed, 26 Apr 2006 06:31:24 -0400 Received: from hermes.iu-bremen.de ([212.201.44.23]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1FYhIp-0002zo-5J for isms@ietf.org; Wed, 26 Apr 2006 06:31:24 -0400 Received: from localhost (demetrius.iu-bremen.de [212.201.44.32]) by hermes.iu-bremen.de (Postfix) with ESMTP id 23FA04C06B; Wed, 26 Apr 2006 12:31:22 +0200 (CEST) Received: from hermes.iu-bremen.de ([212.201.44.23]) by localhost (demetrius [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id 24270-04; Wed, 26 Apr 2006 12:31:20 +0200 (CEST) Received: from boskop.local (unknown [10.50.250.214]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.iu-bremen.de (Postfix) with ESMTP id 7AC92DB5B; Wed, 26 Apr 2006 12:31:20 +0200 (CEST) Received: by boskop.local (Postfix, from userid 501) id 1A7D96C039A; Wed, 26 Apr 2006 12:31:18 +0200 (CEST) Date: Wed, 26 Apr 2006 12:31:18 +0200 From: Juergen Schoenwaelder To: Randy Presuhn Subject: Re: [Isms] isms prototyping status Message-ID: <20060426103118.GA12536@boskop.local> Mail-Followup-To: Randy Presuhn , isms@ietf.org References: <20060425134814.GC9531@boskop.local> <001401c668b1$4a487340$6501a8c0@oemcomputer> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <001401c668b1$4a487340$6501a8c0@oemcomputer> User-Agent: Mutt/1.5.10i X-Virus-Scanned: by amavisd-new 20030616p5 at demetrius.iu-bremen.de X-Spam-Score: 0.0 (/) X-Scan-Signature: de4f315c9369b71d7dd5909b42224370 Cc: isms@ietf.org X-BeenThere: isms@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: j.schoenwaelder@iu-bremen.de List-Id: Mailing list for the ISMS working group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: isms-bounces@lists.ietf.org On Tue, Apr 25, 2006 at 02:43:28PM -0700, Randy Presuhn wrote: > Two things that I've seen with some SMUX and AgentX implementations > that might be at work here to negatively impact performance are > interactions with the Nagel algorithm and with TCP slowstart. Using > the NONAGEL ioctl or its equivalent, if you're not already doing so, > might make a difference. Indeed. After tweaking the sockets a bit this morning, things started to behave much more reasonable. Now we are getting ready to produce some numbers... /js -- Juergen Schoenwaelder International University Bremen P.O. Box 750 561, 28725 Bremen, Germany _______________________________________________ Isms mailing list Isms@lists.ietf.org https://www1.ietf.org/mailman/listinfo/isms