Subject: [Isms] FW: [OPS-DIR] SNMP notification configuration

From: "David Harrington" <[email-masked]>
Date: Fri, 30 May 2008 07:42:47 -0400

-----Original Message-----
From: Pekka Savola [mailto:[email-masked]] 
Sent: Friday, May 30, 2008 3:34 AM
To: David Harrington
Cc: [email-masked]; 'OPS Area'
Subject: Re: [OPS-DIR] SNMP notification configuration

On Wed, 28 May 2008, David Harrington wrote:
> Question #1:
> For SNMP notifications, the SNMP agent will need to act as an SSH
> client, and the SNMP notification receivers will need to act as an
SSH
> server. Will operators find this objectionable?

In our case, routers, switches, etc. are not allowed to log in (ssh 
allow_hosts, firewall rules in various places) to the management 
systems.  As a result this approach would require significant changes 
to ACL policies.

I'm not saying this is a show-stopper, but I suspect many (most?) 
other networks will require similar changes, and depending how easy 
for them it is to enumerate all the possible IP addresses or prefixes 
their SNMP-notifying equipment might use could be a challenge.

> Question #2:
> Would operators prefer to modify their existing user and key
> management solutions, such as implementation-dependent CLI scripts,
to
> configure SSH clients on devices where they may not be found now, or
> would operators prefer to have the ISMS WG develop a standard MIB
> module to configure and manage the SSH credentials needed to have
SNMP
> agents act as SSH clients?

I expects scripts to be used.  I would not expect SNMP (write) MIBs to

be used.  It's possible that a MIB could be used in a read-only mode 
to verify configuration correctness, however.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms

---

From: "David Harrington" <[email-masked]>
Date: Fri, 30 May 2008 07:43:02 -0400

-----Original Message-----
From: Kurt Erik Lindqvist [mailto:[email-masked]] 
Sent: Friday, May 30, 2008 2:23 AM
To: Bernard Aboba
Cc: David Harrington; [email-masked]; 'OPS Area'
Subject: Re: [OPS-DIR] SNMP notification configuration

> Assuming that the SNMP notification receivers are hosts running
sshd,
> this doesn't seem problematic.
>
> > Question #2:
> > management solutions, such as implementation-dependent CLI  
> scripts, to

> Personally, it seems a lot easier to deal with scripts than to  
> attempt to configure SSH via MIBs.

I would actually agree with Bernard. In addition, we have for years  
been trying to get more vendors to implement SSHv2 public key  
authentication, i.e no user/password login exactly to make it easier  
to script.

Best regards,

- kurtis -