Subject: [MIB-DOCTORS] 802.1ag MIB (Dec 24th) Comment on caluse 3.35

From: "Wijnen, Bert \(Bert\)" <[email-masked]>
Date: Thu, 11 Jan 2007 17:01:55 +0100

Norm, David Elie-DitCosaque,

Below is another comment on the document based on more MIB doctor
review. I am not sure that using the suggested "security principal" 
is going to be helpful. I personally can live with the text in 3.35 now.
If anything, we could use securityName instead of "user".
But that again needs word-smitting, maybe chane:

  3.35 Owner: An owner of a system (and in particular, a Bridge) is 
  defined in terms of the user-based security model of SNMPv3.
  An owner is a user (IETF RFC 3414) who has full  access to the System 
  Group  of the SNMPv2-MIB (IETF RFC 3418).

into something like:

  3.35 Owner: An owner of a system (and in particular, a Bridge) is
  defined in terms of a (set of) users (represented by one or more
  securityName values (IETF RFC 3411).  An owner is a (set of) user(s)
  who has (have) full access to the System Group of the SNMPv2-MIB
  (IETF RFC 3418).

Do you think this is still doable at this stage?

Bert  

-----Original Message-----
From: Juergen Schoenwaelder [mailto:[email-masked]]
Sent: vrijdag 29 december 2006 21:49
To: David T. Perkins
Cc: Wijnen, Bert (Bert); David B Harrington; MIB Doctors \(E-mail\)
Subject: Re: Owner in IEEE 802-1ag

On Fri, Dec 29, 2006 at 12:33:07PM -0800, David T. Perkins wrote:
 
> The following is found in IEEE802-1ag-d7-1:
>  3.35 Owner: An owner of a system (and in particular, a Bridge) is 
> defined in terms of the user-based security model of SNMPv3.
>  An owner is a user (IETF RFC 3414) who has full  access to the System

> Group  of the SNMPv2-MIB (IETF RFC 3418).
> 
> I believe that "user" is inappropriate, and instead the term "security

> principal" should be used, which is security model independent.
> 
> I hope there are no other places that others are using security model 
> specific terms instead of security model independent terms, especially

> now that there is more than one supported security for the SNMPv3 
> protocol.

And they assume that there is always one and exactly one "user" who has
full access to the System Group of the SNMPv2-MIB? How does this go
along with say appendix A.1 in RFC 3414? What happens if someone
configures security names and access control rules leading to multiple
owners?

/js

_______________________________________________
MIB-DOCTORS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mib-doctors