Subject: Re: SSHv2 MIB?

From: [email-masked]
Date: Tue, 9 Dec 2003 13:11:47 -0500

Hi Niels,
  The management software talks to SNMP agent (daemon).  The SNMP agent in
turn calls functions in sshd task to read or write to sshd configuration.
The MIB tells me what function calls I need to implement in the sshd task
to support SNMP agent.  For example, OSPF has a mib for it:
http://www.ietf.org/internet-drafts/draft-ietf-ospf-mib-update-07.txt

Thanks.

Tam

                    nisse@lysator.                                                                            
                    liu.se (Niels        To:     [email-masked]                                           
                    Möller)              cc:     [email-masked], [email-masked]                         
                    Sent by:             Subject:     Re: SSHv2 MIB?                                          
                    nisse@lysator.                                                                            
                    liu.se                                                                                    

                    12/09/2003                                                                                
                    12:24 PM                                                                                  

[email-masked] writes:

>   The Network Management software (ex: OpenView or other enterprise
network
> management software) configure SSH configuration via SNMP/MIB.

Which ssh implementations support that? Or is the management software
talking to some separate daemon that speaks SNMP and then writes to
the sshd configuration file and reads the sshd log files?

> I'm surprise that there is no MIB, since most protocols have their
> MIBs. Are you part of the IETF working group?

I'm a member of the working group, and author of one ssh
implementation. (I have to admit that I'm not particularly fond of
SNMP, and other ASN.1 use within the ietf, but if there some IETF work
on an ssh MIB, I'm surprised I've been able to miss it completely).

Regards,
/Niels

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 09 Dec 2003 13:24:24 -0500

Somehow I missed the original query to the WG list.

I am unaware of any existing work on an SSH SNMP MIB.  (I think your
question is the first time it's been asked about)

Existing implementations are typically managed through configuration
files or the equivalent.

					- Bill
				(speaking as WG chair..)

---

From: Chris Lonvick <[email-masked]>
Date: Tue, 9 Dec 2003 10:51:37 -0800 (PST)

Hi,

> Existing implementations are typically managed through configuration

Splitting hairs and picking nits follows- but where it leads may be
interesting to some on this list.

It appears that MIBs and SNMP have been used for monitoring and not for
configuration or provisioning.  That was the conclusion of the OAM Area
(Bert Wijnen and Randy Bush) when they commissioned the Netconf WG to look
into a mechanism to configure and provision network devices.  SNMP will
continue to be used for monitoring devices.  The WG has split out the
transport problem from the mechanism and is contemplating
 SOAP
 BEEP (as defined in RFC 3195)
 SSH (as is being defined in this WG).

The Netconf WG Charter is here:
  http://www.ietf.org/html.charters/netconf-charter.html
The use of SSH is expressed here:
  http://www.ietf.org/internet-drafts/draft-ietf-netconf-ssh-00.txt

Please do not jump into the Netconf discussion and start cheering for your
favourite protocol.  There are advantages and disadvantages to each of the
proposals in this application.  A lot of the discussion may be found here:
  http://www.ops.ietf.org/netconf/

As I said, I hope this is of interest to some on the list.

Thanks,
Chris

---

From: Darren J Moffat <[email-masked]>
Date: Fri, 12 Dec 2003 11:48:33 -0800 (PST)

> Existing implementations are typically managed through configuration

Not only that but what is configurable and what that means is very
variable between implementations.

IMO having a common config interface to the SSH protocol server doesn't
make any sense.  In vendors wish to add that support then it would be
specific to what they allow in configuration.

I just can't see what you would want to configure in a standard way that
would make writting a standard MIB worth while.

--
Darren J Moffat