Subject: Re: 2574 OBJECTS (was Alarm MIB security issues)

From: Randy Presuhn <[email-masked]>
Date: Tue, 30 Apr 2002 10:18:01 -0700 (PDT)

Hi -

> Message-Id: <[email-masked]>
> Date: Mon, 29 Apr 2002 19:01:22 -0700
> To: [email-masked]
> From: "David T. Perkins" <[email-masked]>
> Subject: Re: 2574 OBJECTS (was Alarm MIB security issues)
> In-Reply-To: <[email-masked]>
...
> >As a technical contributor, I'd like to remind you that several
> >objects in RFC 2574 have the same "bug"/"feature" regarding the
> >ability to use SNMP to extract a system's configuration.
> 
> Other than the keys, what objects have the attribute that you can
> not retrieve values set via SNMP so that you can restore the
> configuration via SNMP?
...

I was referring to the keys, obviously.  They're a critical
part of a system's configuration.  If you don't know what
they are, you can't do much at all.  By design.  That's why
I'm skeptical about any sort of "requirement" to make all
the bits needed to support explicit (or even implicit)
delegation recoverable via the MIB.

A sane security administrator would probably chose to use group
or user names to index these MIBs, making the administrative
issues of managing access trivial:  only the members of an
authorized group would be able to access the tables, and in
VACM, all members of a group have identical access rights
by definition.

 ------------------------------------------------------
 Randy Presuhn          BMC Software, Inc.  1-3141
 [email-masked]  2141 North First Street
 Tel: +1 408 546-1006   San José, California 95131  USA
 ------------------------------------------------------
 My opinions and BMC's are independent variables.
 ------------------------------------------------------