Subject: RE: [Isms] Summary of Authorize Only issue

From: "Nelson, David" <[email-masked]>
Date: Thu, 27 Jul 2006 14:11:04 -0400

(Dropping RADEXT from the distribution.)

Dave Harrington writes...

> I'm not sure how a SSH-VPN is configured, i.e. whether
> it uses a subsystem to carry snmp.

In response to a comment from Dave Perkins...

> There is one "real" issue. That is the confusion of 
> using 1) SSH for a VPN with port redirect with 
> 2) SNMPv3/ISMS-SSH.  For #1 (a VPN), this is outside the 
> scope of this WG discussion. However, the docs need to 
> be clear that SNMPv3/ISMS-SSH is not #1.

I'm not sure what VPNs have to do with the work of ISMS.  I understand
that VPNs are a form of encrypted tunnel, and one could characterize the
protected transport service that SSH provides fro various application
protocols as an encrypted tunnel.  Still, there is a lot of added
functionality entailed in VPNs that is not needed (or specified) for
SNMP over SSH.

Is all this a red herring?

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David Harrington" <[email-masked]>
Date: Thu, 27 Jul 2006 14:59:12 -0400

Hi David,

David said and David responded and David asked ...

Hmmm.

It is not a red herring.

DP simply pointed out that some people already use an "SNMP over SSH"
solution, using SSH with a port-redirect approach. This is sometimes
referred to as an SSH "VPN".

DP asked that we use terminology that unambiguously refers to the
service ISMS is working on, and not the other "VPN"-style of "SNMP
over SSH" service.

The SSHSM draft requests an "snmp" subsystem from SSH, so I suggest we
use "SSH snmp subsystem" in the RADIUS attribute for the
base-authorization.

Dbh

> -----Original Message-----
> From: Nelson, David [mailto:[email-masked]] 
> Sent: Thursday, July 27, 2006 2:11 PM
> To: [email-masked]
> Subject: RE: [Isms] Summary of Authorize Only issue
>

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 27 Jul 2006 14:57:06 -0400

> Is all this a red herring?

The word "VPN" might be.  The point David is trying to get at is that 
there's a difference between SNMPv3 with SSHSM, and SNMPv3 with USM over 
TCP tunnelled through an SSH port forwarder, but both can be described as 
"SNMP over SSH".

The solution to this is that we call the thing "SNMP over SSH (RFCxxxx)".

-- Jeff