Subject: [Isms] ISMS #3: passing username to the SSH layer

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 23 Jan 2008 21:47:17 +0100

ISMS #3: passing username to the SSH layer
Status: open

Section 5.3 of draft-ietf-isms-secshell-09.txt contains the following
text:

   2) The provided transport domain, transport address, securityName and
   securityLevel are used to lookup an associated entry in the Local
   Configuration Datastore (LCD).  Any model-specific information
   concerning the principal at the destination is extracted.  This step
   allows preconfiguration of model-specific principals mapped to the
   transport/name/level, for example, for sending notifications.

   In an implementation-specific manner, pass the username extracted
   from the LCD to the SSH layer.  [TODO: this may need to be
   standardized.]

This might be the reverse operations of what we have in ISMS #2 but I
am not sure.

Q3.1: Clarify what the issue is that needs to be solved. Is it just
      the reverse of ISMS #2 or something bigger? Does it need to be
      standardized?

Q3.2: If yes, how does the to be standardized mapping look like?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David Harrington" <[email-masked]>
Date: Wed, 23 Jan 2008 16:28:05 -0500

Hi,

I think this is slightly different than #2, although it is related to
#2.

In much the same way that multiple authn protocols can be mapped to a
single securityname for incoming messages, a single securityname can
be mapped to multiple authn protocols for outgoing messages. Unless
the transform is always the identity transform, this may need to be
standardized so we can be sure we get the right security credentials
for the outgoing message. This is probably most important for
notifications, where an administrator might want to ensure that the
notification is sent using a specific principal using a specific
secure-enough protocol.

An administrator needs to be able to configure the appropriate
references to securityname and probably to authn protocol for
notifications (e.g., the target-table stuff). To make it possible to
configure this using SNMP, administrators should be to be able to
configure this in a vendor-independent manner, so we may need to
standardize some of this. If this is left as an
implementation-dependent detail, then it becomes much harder for
administrators to configure target-table et al across their SNMP
domain.

Put another way, the target-table stuff is actually part of the LCD,
and it is unclear whether we have everything we need standardized
enough to work as designed. We need to determine whether there is more
stuff in the LCD that needs standardizing in order to work for various
use cases.

dbh

> -----Original Message-----
> From: Juergen Schoenwaelder 
> [mailto:[email-masked]] 
> Sent: Wednesday, January 23, 2008 3:47 PM
> To: [email-masked]
> Subject: [Isms] ISMS #3: passing username to the SSH layer
>