Subject: RE: [Isms] discovery

From: Miao Fuyou <[email-masked]>
Date: Thu, 04 Jan 2007 09:58:20 +0800

Is the discovery mechanism security-model-agnostic, or specific to a model,
such as sshsm?

If it is specific to sshsm,  host key of the managed device may be the piece
of data to be discovered. The SSH specification says the host key is
delivered out of band, it will be convenient for deployment if it can be
discovered. 

Thanks,
Miao

> -----Original Message-----
> From: David Harrington [mailto:[email-masked]] 
> Sent: Thursday, December 28, 2006 4:06 AM
> To: [email-masked]; [email-masked]
> Subject: [Isms] discovery
> 
> Hi,
> 
> I recommend standardizing the discovery mechanisms to include 
> three pieces of data - contextengineID, sysDescriptor, and 
> sysObjectID.
> Those three items  identify the SNMP entity. 
> 
> Naming the variables that can be returned by a compliant 
> implementation of this mechanism allows us to discuss the 
> security considerations of the data revealed. Leaving it to 
> the implementation to allow any data in the request/response 
> makes it pretty much impossble to describe the security 
> implications of the discovery mechanism.
> 
> It could be argued that additional system objects could be 
> included in the discovery, and we can discuss the security 
> implications of including those in the request.
> 
> David Harrington
> [email-masked]
> [email-masked]
> [email-masked]
> 
> 
> 
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/isms
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 4 Jan 2007 08:43:10 +0100

> delivered out of band, it will be convenient for deployment if it can be

The introduction of <draft-schoenw-snmp-discover-00.txt> says:

   This document introduces a discovery mechanism which can be used to
   learn the engine identifier of a remote SNMP protocol engine.  The
   proposed mechanism is independent of the features provided by SNMP
   security models and may be used also by other protocol interfaces to
   discover the engine identifier.

So yes, the intention is to be security model agnostic. And the
intention is to just focus on engineid discovery.

If you believe something specific should be done for SSH host keys,
then <draft-ietf-isms-secshell-05.txt> is probably the document to
look at.

/js

-- 
Juergen Schoenwaelder		 {International|Jacobs} University Bremen
<http://www.eecs.iu-bremen.de/>	 P.O. Box 750 561, 28725 Bremen, Germany