Subject: Re: [Isms] open issues

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 02 May 2008 17:23:54 -0400

--On Wednesday, April 30, 2008 10:01:37 AM +0300 [email-masked] 
wrote:

> Juergen Schoenwaelder wrote:
>
>> > And if a given transportAddress has just one principal behind it,
>> > we don't really have problems with SSH either, right?
>>
>> Almost. And SSH hostkey, as I understand it, identifies a host, not
>> just a transport endpoint. But there might be ways to weak SSH to use
>> different hostkeys for different transport endpoints on the same host.
>
> Although the SSH RFCs talks about "hosts", if a host would have more
> than one SSH server running, they could have different "host" keys
> (just like if you have multiple applications using TLS on the same
> host, they might need different certificates).

That is correct.  So, if you're sending SNMP notifications, the right way 
to think about this is not that you're going to connect to an sshd and have 
it demultiplex, but that you'll have been given a transport endpoint which 
reaches an sshd with the intended recipient's credentials.

> (I think we can handle the latter: the securityName given by the
> notification originator application would identify the intended
> recipient, and would be used for access control on the notification
> originator side -- but the SSH user name sent when connecting
> to the notification receiver would identify the originator.)

Yes, exactly so.  Interestingly, there is nothing in SSH that says that 
"host keys" must belong to an Internet host, or to an IP address, or to a 
hostname.  In fact, SSH says very little at all about how clients should 
track host keys.

-- Jeff
_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms