Subject: Suggestions for the RADIUS integration draft (was RE: [Isms] SNMP "access control" terminology)

From: "Nelson, David" <[email-masked]>
Date: Fri, 7 Jul 2006 10:28:46 -0400

David Harrington writes...

> In particular, I sugggest that the first three chapters introduce the
> technologies that will be integrated, and set the terminology that
> will be used when referring to similar concepts while discussiing
> specific portions of the integration:
> 
> 1. Introduction
> 1.1 An introduction to RADIUS functionality (with no mention of SSH or
> SNMP)
> 	identify the terms that will be used to reference the
> functionality of RADIUS
> 1.2 An introduction to SSH functionality (with no mention of RADIUS or
> SNMP)
> 	identify the terms that will be used to reference the
> functionality of SSH
> 1.3 An introduction to SNMP transport security (with no mention of
> SSH, RADIUS, or VACM)
> 	identify the terms that will be used to reference the
> functionality of SNMP transport security
> 1.4 An introduction to SNMP operations access control
> 	identify the terms that will be used to reference the
> functionality of SNMP operations access control
> 
> 2. Integration for transport security
> 	why integration for transport security is desired
> 2.1 How SNMP will use SSH to provide transport security (with no
> mention of RADIUS)
> 	to authenticate clients
> 	to establish a session-level subsystem for SNMP message
> security
> 2.2 How SSH frequently uses RADIUS (with no mention of SNMP)
> 	to suthenticate clients
> 	to authorize an SSH subsystem
> 2.3 How SSH can use RADIUS when SSH is providing transport security
> for SNMP
> 	to authenticate clients
> 	to authorize an SSH subsystem called "snmp"
> 
> 3. Integration for SNMP operations access control
> 	why integration for SNMP operations access control is desired
> 	two main ways to approach getting the information from RADIUS:
> 3.1 using an ACM subsystem add-on to act as a RADIUS client
> 	directly contact the RADIUS server (without using SSHSM)
> 3.2 using SSH to gather and cache RADIUS attributes
> 	3.2.1 attributes to specify SNMP operations access control
> parameters
> 	3.2.2 having SSH or SSHSM cache the information
> 	3.2.3 subsequent use of the cached attributes by an ACM
> subsystem add-on.

This seems like a reasonable outline for incorporation of the -01
revision of the RADIUS integration draft.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms