Subject: [Isms] ssh authn

From: "David Harrington" <[email-masked]>
Date: Wed, 21 Jan 2009 11:19:16 -0500

client and server authn mixed into this paragraph?

Using tmTransportAddress, the client will establish an
        SSH transport connection using the SSH transport protocol,
        authenticate the server, and exchange keys for message
        integrity and encryption. The tmTransportAddress field may
        contain a user-name followed by an '@' character (ASCII 0x40)
        that will indicate a specific user-name string that should be
        presented to the ssh server as the "user name" for
        authentication purposes. This MAY be different than the passed
        tmSecurityName value that will be used in the remaining steps
        below. If there is no specified user-name in the
        tmTransportAddress then the tmSecurityName should be used
        as the user-name. The other parameters of the transport
        connection and the credentials used to authenticate the
        server are provided in an implementation-dependent manner.

David Harrington
[email-masked]
[email-masked]
[email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 22 Jan 2009 20:47:22 +0100

> In the following paragraph, is this all about server authn, or is

I am not sure where your question is supposed to leads to. The text
tells me that the user-name portion of the tmTransportAddress if
present is used as the ssh user name instead of tmSecurityName.  The
user name is relevant for SSH client authentication, not for SSH
server authentication. That said, I am still wondering what the reason
behind your question is...

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms

---

From: "David Harrington" <[email-masked]>
Date: Thu, 22 Jan 2009 16:32:01 -0500

sentence 1 talks about server authn, which I assume means RFC4253.
sentences 2-4 talk about user authn, which I assume means RFC4252
sentence 5 talks about server authn, which I assume means RFC4253.

It strikes me that this paragraph should be reworked to separate the
server auth and the user auth discussions.

Unless, of course, I am misunderstanding this text.
Maybe this is about how to use tmTransportAddress during server authn,
and it just is not clear.

is this all about server authn, or is client and server authn mixed in
this paragraph?

dbh

> -----Original Message-----
> From: Juergen Schoenwaelder 
> [mailto:[email-masked]] 
> Sent: Thursday, January 22, 2009 2:47 PM
> To: David Harrington
> Cc: [email-masked]
> Subject: Re: [Isms] ssh authn
> 
> On Wed, Jan 21, 2009 at 11:19:16AM -0500, David Harrington wrote:

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 23 Jan 2009 00:10:08 +0100

> Hi,

So you want to change this text to something like this:

   Using tmTransportAddress, the client will establish an SSH
   transport connection using the SSH transport protocol, authenticate
   the server, and exchange keys for message integrity and encryption.
   The parameters of the transport connection and the credentials used
   to authenticate the server are provided in an implementation-dependent
   manner.

   The tmTransportAddress field may contain a user-name followed by an
   '@' character (ASCII 0x40) that will indicate a specific user-name
   string that should be presented to the ssh server as the "user
   name" for user authentication purposes. This user-name MAY be
   different than the passed tmSecurityName value that will be used in
   the remaining steps below. If there is no specified user-name in
   the tmTransportAddress then the tmSecurityName should be used as
   the user-name.

Such a change is fine with me.

/js

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 22 Jan 2009 21:41:41 -0500

> sentence 5 talks about server authn, which I assume means RFC4253.

The distinction between the different SSH documents is largely opaque to 
SNMP, which operates at a higher layer.

> is this all about server authn, or is client and server authn mixed in

It's not about server authentication, or client authentication.  It's about 
how the client discovers the things it needs to know to establish an SSH 
connection, most of which are or can be contained in the 
tmTransportAddress, and some of which come from other places.  I think it's 
quite clear and meaningful the way it is.

-- Jeff

---

From: "tom.petch" <[email-masked]>
Date: Tue, 27 Jan 2009 17:57:55 +0100

I have no problem with the original formulation.

If you do opt for Juergen's, I would prefer 'other parameters' - as in the
original - to just 'parameters'.

Tom Petch

----- Original Message -----
From: "Juergen Schoenwaelder" <[email-masked]>
To: "David Harrington" <[email-masked]>
Cc: <[email-masked]>
Sent: Friday, January 23, 2009 12:10 AM
Subject: Re: [Isms] ssh authn

> On Thu, Jan 22, 2009 at 04:32:01PM -0500, David Harrington wrote:
> > Hi,
> >