Subject: [Isms] RE: An ACM/RADIUS integration

From: "Nelson, David" <[email-masked]>
Date: Wed, 28 Jun 2006 15:49:21 -0400

David Harrington writes...
 
> There are a number of potential solutions for using RADIUS for SNMP
> authorization. Some have been discussed to a degree. There seem to be
> two general things to consider:
> 1) what does the AAA server provide?
> 2) how does the server get contacted?

Modulo my previous comments about how SSH interacts with RADIUS/AAA to
provision SNMPv3 service, this description of "how it might work"
coincides with my own thinking.

Specific comments in-line.  Sections deleted for brevity.

> (To me, this seems like using RADIUS to perform SNMP operations to
> configure the ACM model's MIB module, and it would require lots of
> info to be passed when the user initially makes a request. It also
> seems to imply that every user needs a customized VACM configuration,
> which I doubt is likely in real world deployments.)

I agree.

> In the interim meeting one approach we discussed was an add-on to the
> ACM subsystem, in which the ACM subsystem extension is a AAA client
> whose job is to contact a AAA server and ask for the SNMP
> authorization information for a specified securityName. There is a
> security association between this client and the server that may be
> totally independent of any security association between the SSH
> transport-mapping's SSH client and any AAA server it uses.

This represents the preferred "Authorize Only" mode of operation.

> Another approach works only when the same AAA server is advising a
> secure transport protocol (e.g. SSH) for the SNMP messages. When SSH
> user-auth is performed to establish a secure connection and an "snmp"
> SSH subsystem, the AAA server also passes along the information about
> the SNMP-ACM policies to apply to the SSH-specified user-name for the
> session. The AAA attributes get cached and passed to the ACM subsystem
> (or model) for subsequent use.

This represents the non-preferred "Authenticate and Authorize" mode of
operation, i.e. the way RADIUS normally works.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms