Subject: RE: [Isms] SNMP "access control" terminology

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 6 Jul 2006 13:32:00 -0400

>> >Why should a user who is not authorized to use the system be allowed
>> >to create and keep an open SSH session? And why should such a user
be
>> >allowed to send SNMP packets even if they will return just
exceptions?
>> 
>> Because he is allowed to login as a system user, and you opted for a
>> common auth strategy? So he's perfectly OK to login via SSH, but not
OK
>> to use SNMP?
>
>Sorry, I was not clear. What I wrote "keep an open SSH session" I
>actually meant "keep an open SSH session to an SNMP subsystem".

User may not be allowed to KEEP an open SSH session TO SNMP SUBSYSTEM,
but he certainly should (and will) be allowed to pass through SSH
authentication and hold that session open until authorization comes up
with an answer. And since the authorization in SNMP works on per-object
basis (unlike authentication that's on per-packet or per-request, or
even per-bunch-of-requests-named-session).

So for practical reasons result is the same: user has an open SSH
session while authorization process is running.

>> If you aren't allowed SSH - clearly you aren't allowed SSH-based
SNMP.
>> The reverse isn't true.
>
>I am not even sure the first is generally true.

Well, you did want common auth base, didn't you? One implication is that
whoever is listed in that common auth database, can get
SSH-authenticated and thus open an SSH session. How long that session
will stay alive - is a different question that depends on who decides
what on the other end of the SSH pipe.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 6 Jul 2006 20:28:37 +0200

> session while authorization process is running.

According to your interpretation of the word authorization. Our
dilemma is that we do not have the same interpretation of this 
term.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany