Subject: RE: [Isms] SNMP "access control" terminology

From: "Nelson, David" <[email-masked]>
Date: Thu, 6 Jul 2006 10:27:36 -0400

Uri Blumenthal writes...
> >The motivation for RADIUS is to be able to control from a centralized
> >system which authenticated user has the right to manage a device.
> 
> The danger is - local and central repositories of users diverging.

How is this different from NIS vs. /etc/passwd?  My experience in
enterprise environments is that the "real" users exist in NIS, and
/etc/passwd contains root and sysadm accounts for "emergency" access to
the system by the administrators when NIS is broken.  I haven't seen any
environments where organizations try to maintaining *both* centralized
and distributed (local store) user credentials.  I agree that would be a
Bad Idea (tm).

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David Harrington" <[email-masked]>
Date: Thu, 6 Jul 2006 11:27:06 -0400

Hi

Note that I changed the subject line, since it is not abuot "access
control" terminology.

I agree with this comparison, and recommend that the RADIUS draft
security considerations make the point that there should be a very
limited set of local users for emergency access to supplement the
RADIUS approach for emergency plus others.

dbh

> -----Original Message-----
> From: Nelson, David [mailto:[email-masked]] 
> Sent: Thursday, July 06, 2006 10:28 AM
> To: [email-masked]
> Subject: RE: [Isms] SNMP "access control" terminology
> 
> Uri Blumenthal writes...