Subject: RE: draft-chisholm-disman-active-alarm-01.txt

From: "Ayers, Mike" <[email-masked]>
Date: Wed, 1 Nov 2000 11:27:15 -0600

> From: Sharon Chisholm [mailto:[email-masked]]
>
> hi
>
> I start holidays tomorrow, so I will be reading any other
> comments and suggestions when I get back November 26th.
> Please do reply though.
>
> I can certainly incorporate the corrections, but I have a
> question about the security information.  From my copy of
> X.736:
>
> Security alarm detector - This parameter identifies the detector
> of the security alarm.
>
> Service user - This parameter identifies the service-user whose
> request for service led to the generation of the security alarm.
>
> Service provider - This parameter identifies the intended service-provider

> of the service that led to the generation of the security alarm.

	I get the same readings.

> These seem to apply to only a small subset of alarms.  Wouldn't it
> then be better to go with the option you also suggested of just
> having them as varbinds in the trap, and therefore present in the
> alarmActiveVariablesTable?

	Actually, I think they apply to about half the alarms, since my copy
of X.736 states that they are mandatory for all security alarms.  Does yours
read the same (mine is not a final copy, unfortunately)?

	I don't object to these objects being in the
alarmActiveVariablesTable, but I do think that there should be objects
defined specifically for them somewhere in the Active Alarm MIB so that they
can be identified as such.

> Also, are there any security implications of making this available in
> a MIB?  I know a lot of systems have a way of turning off the SNMP
> authentication failure trap for this reason.

	I'll look into this, but I suspect that there would not be a
problem, assuming the use of SNMPv3.  However, now that you mention it,
section 9 might wish to mention that if unauthenticated or unencrypted
access to the MIB is permitted, intruders may be able to discover current
weak points in the system, since such MIBs are often used to monitor
computer networks.

> thanks,
>
> Sharon
>
> PS.  I send explicitly as plain text, it just arrive as html. Network
>      Gremlins.
>

	Some network admin is doing us a "favor", isn't that sweet?

/|/|ike