Subject: Re: Fwd: [Isms] EUSM key localization details

From: Kaushik Narayan <[email-masked]>
Date: Fri, 05 Nov 2004 09:10:30 -0800

Hi Randy,

Please find my reply inline.

>Hi -
>
>Page16 of draft-kaushik-snmp-external-usm-00.txt describes
>how a RADIUS server will generate a localized key.  It says that the
>server will have to have been configured with the set of SNMP Engine
>IDs in use by the AAA server.  What isn't clear to me from the text is
>how the RADIUS server can know *which* of those SNMP Engine IDs
>to use in key localization.

Administrators MUST configure the SNMP-Engine-ID on the AAA server
as part of the AAA client configuration for the SNMP agents. This will
help the AAA server locate the SNMP-Engine-ID for the agent that
is requesting keys.

>The RADIUS key request from the SNMPv3 agent carries the SNMP
>manager's IP address, (as the "Calling-Station-ID") and the user
>name (as the "User-Name"), but there's nothing for the agent's SNMP
>Engine ID.

We did not want the agents to pass the SNMP-Engine-ID since a
compromised agent can acquire localized keys for other agents.

regards,
  kaushik!

>Randy
>
>
>
>_______________________________________________
>Isms mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 05 Nov 2004 11:58:09 -0800

>>>>> On Fri, 05 Nov 2004 09:10:30 -0800, Kaushik Narayan <[email-masked]> said:

Kaushik> Administrators MUST configure the SNMP-Engine-ID on the AAA
Kaushik> server as part of the AAA client configuration for the SNMP
Kaushik> agents. This will help the AAA server locate the
Kaushik> SNMP-Engine-ID for the agent that is requesting keys.

That's not very scalable though.

-- 
Wes Hardaker
Sparta

---

From: Kaushik Narayan <[email-masked]>
Date: Fri, 05 Nov 2004 14:40:58 -0800

Hi Wes,

We have discussed the scalibility issue since manually configuring
the AAA server with all SNMP engine IDs can be really tedious and
were looking at optimization where we had the SNMP agent pass
the SNMP engine ID and the AAA server would verify that engine ID
if it was configured or accept the SNMP engine ID passed by the
agent if none is configured.

regards,
   kaushik!

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 5 Nov 2004 18:24:05 -0500

If the AAA server doesn't recognize the engineID,  what authorization
does it give by default? 
I would expect that the AAA server would need to know which group
permissions should be given to a user on a per-device basis.

This could be handled by simply associating the user toa group, and
then configuring only certain groups to certain devices, but that
makes the configuration of VACM more difficult. At some point the
difficulty of configuring engineIDs into a centralized AAA server may
be easier than configuring different VACM policies onto different
devices.

David Harrington
[email-masked]

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Kaushik Narayan
> Sent: Friday, November 05, 2004 5:41 PM
> To: Wes Hardaker
> Cc: [email-masked]
> Subject: Re: Fwd: [Isms] EUSM key localization details
> 
> Hi Wes,
> 
> We have discussed the scalibility issue since manually 
> configuring the AAA server with all SNMP engine IDs can be 
> really tedious and were looking at optimization where we had 
> the SNMP agent pass the SNMP engine ID and the AAA server 
> would verify that engine ID if it was configured or accept 
> the SNMP engine ID passed by the agent if none is configured.
> 
> regards,
>    kaushik!
>

---

From: Kaushik Narayan <[email-masked]>
Date: Fri, 05 Nov 2004 16:56:30 -0800

Hi Dave,

The authorization of the engine IDs can be done via a variety
of policies including user groups assigned to the user. In most
of our prototype work we have had the AAA server import the
devices and their engine IDs from SNMP Manager.

regards,
   kaushik!

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 05 Nov 2004 21:19:33 -0800

>>>>> On Fri, 05 Nov 2004 16:56:30 -0800, Kaushik Narayan <[email-masked]> said:

Kaushik> In most of our prototype work we have had the AAA server
Kaushik> import the devices and their engine IDs from SNMP Manager.

Chicken, meet Egg.  Egg, meet Chicken.

-- 
Wes Hardaker
Sparta

---

From: Kaushik Narayan <[email-masked]>
Date: Sat, 06 Nov 2004 10:33:44 -0800

Hi Wes,

Actually it was not a chicken and egg problem with EUSM since
the process for Discovery of engine IDs for authoritative agents
still stays the same as described in RFC3414, i.e. we continue
to use a Request message with a securityLevel of  noAuthNoPriv
and the response to this message will be a Report message
containing the snmpEngineID.

This would mean that agents do-not need to acquire keys to serve
an SNMPv3 engine ID discovery request and SNMP Managers can
discovery engine IDs and bootstrap the AAA server.

regards,
   kaushik!

---

From: "Randy Presuhn" <[email-masked]>
Date: Sun, 14 Nov 2004 23:06:21 -0800

Hi -

> From: "Kaushik Narayan" <[email-masked]>
> To: "Wes Hardaker" <[email-masked]>
> Cc: <[email-masked]>
> Sent: Saturday, November 06, 2004 10:33 AM
...
> discovery engine IDs and bootstrap the AAA server.
...

Which brings us back to my question at the start of this thread:
how does the AAA server know *which* of the SNMP engine IDs
to use?  The information described in the proposal as flowing in
the RADIUS Key_Request   (Key (App ID),  Calling-Station-ID,
User-Name) is not sufficient to map to a single engine ID, since
there may be multiple SNMP engines in a single system.

Randy

---

From: "Joseph Salowey" <[email-masked]>
Date: Mon, 15 Nov 2004 08:49:58 -0800

[email-masked] wrote:
>> Subject: Re: Fwd: [Isms] EUSM key localization details ...
>> This would mean that agents do-not need to acquire keys to serve an
>> SNMPv3 engine ID discovery request and SNMP Managers can discovery
>> engine IDs and bootstrap the AAA server.
> ...
> 
> User-Name) is not sufficient to map to a single engine ID,
> since there may be multiple SNMP engines in a single system.
> 

[Joe] Yes I think we need an attribute to contain the SNMP Engine ID making
the request.  I'm not sure if we can use existing attributes to convey this
information, we may need to create a new one.  The AAA server still should
verify that the engine ID is authorized to the RADIUS client making the
request.

---

From: Kaushik Narayan <[email-masked]>
Date: Mon, 15 Nov 2004 11:44:03 -0800

Hi All,

There can be multiple schemes of authorization as discussed previously
on the list. You could verify the engine ID to authorize based on the identity
of the engine requesting the keys, there could also be policies for unknown
engine IDs which might be based on user access to agents.

regards,
   kaushik!

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 15 Nov 2004 21:08:03 +0100

> engine IDs which might be based on user access to agents.

Would it make sense to leverage SNMP URIs in this context?

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: Kaushik Narayan <[email-masked]>
Date: Thu, 18 Nov 2004 11:15:26 -0800

Hi Juergen,

Are you suggesting the use of SNMP URIs to identify agents
and passed in the key request to the key server?

regards,
  kaushik!

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 18 Nov 2004 20:43:42 +0100

> and passed in the key request to the key server?

I have not read the EUSM specs in detail - it just sounded from the
uniformed outside like you needed to identify SNMP service endpoints
which SNMP URIs are supposed to do (and they can carry engineIDs).

So take it as a suggestion to think about - I am not going to fight
for this if the folks who are much more familiar with EUSM think
this is a stupid suggestion. (Keith is involved in the SNMP URI
stuff and in EUSM so he should be able to give a quick answer.)

/js

---

From: Keith McCloghrie <[email-masked]>
Date: Thu, 18 Nov 2004 12:29:39 -0800 (PST)

> stuff and in EUSM so he should be able to give a quick answer.)
 
There is at least one non-SNMP situation (and there will likely be more
in the future), where a URL/URI format was selected as a generic
mechanism to identify management information (and how to access it).
In order to extend that one situation to include SNMP and MIB objects,
and because there was no standard method to use for such encoding, an
ad hoc method was used.  The "SNMP URI stuff" is trying to do catch-up
by specifying a standard and avoid future anarchy in such situations.

I think it would be overkill to use an URI in EUSM merely for the
purpose of encoding an engine-id.

Keith.