Subject: [Isms] KSM for SNMPv3//Re: isms meeting summary

From: Tina TSOU <[email-masked]>
Date: Thu, 11 Nov 2010 10:31:44 +0800

Hi,
Kerberos provides centrally administered authentication, authorization  
and message protection for large scale networks.  This model broads  
SNMP to leverage that infrastructure.
So I support KSM for SNMPv3 becoming a WG item.

B. R.
Tina
http://tinatsou.weebly.com

On 11/10/10 10:37 AM, "Juergen Schoenwaelder"
<[email-masked]> wrote:

> Hi,
>
> below is a short ISMS meeting summary. The more detailed minutes are
> under preparation.
>
> The ISMS working group met in a one hour session on Wednesday at 15:10
> to discuss a proposal for a Kerberos security model. The discussion
> centered around the question of whether or not a Kerberos security
> model should be added to the existing set of security models.  At the
> end of the meeting, which was attended by a relatively small number of
> people, there was no consensus in the room as to whether or not the WG
> should take on the work to develop a Kerberos security model. The
> chairs have to address the need and adoption issue with the mailing
> list. For the (D)TLS transport of SNMP and related specifications,
> interoperability testing is ongoing with the goal to advance the
> specifications to Draft Standard.
>
> /js
>
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
> Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/isms

---

From: "Shorey, Robert Mr CTR USA USAASC USA" <[email-masked]>
Date: Tue, 16 Nov 2010 07:32:46 -0700

I support KSM for SNMPv3 becoming a working group item. The advantages I see
are the ability to take advantage of existing technology deployment
(identity and authorization management already in place), consistency
(manage identities, groups, and authorizations in one place), lower
management workload, scalability, simplicity, and low complexity and
computational load on the managed devices.

Thanks,

Rob Shorey

Mobile: (719) 321-4380

From: [email-masked] [mailto:[email-masked]] On Behalf Of Tina
TSOU
Sent: Wednesday, November 10, 2010 7:32 PM
To: Juergen Schoenwaelder
Cc: [email-masked]
Subject: [Isms] KSM for SNMPv3//Re: isms meeting summary

Hi,

Kerberos provides centrally administered authentication, authorization and
message protection for large scale networks.  This model broads SNMP to
leverage that infrastructure.

B. R.

Tina

http://tinatsou.weebly.com <blockedhttp://tinatsou.weebly.com> 

On 11/10/10 10:37 AM, "Juergen Schoenwaelder"
<j.schoenwaelder@jacobs-univ
<blockedmailto:[email-masked]>  ersity.d blockquote
type="cite">Hi,

 <blockedmailto:[email-masked]> 

below is a short ISMS <blockedmailto:[email-masked]>
meeting summary. The more detailed minutes are

under preparation. <blockedmailto:[email-masked]> 

 <blockedmailto:[email-masked]> 

The ISMS working <blockedmailto:[email-masked]>  group
met in a one hour session on Wednesday at 15:10

to discuss a proposal <blockedmailto:[email-masked]>
for a Kerberos security model. The discussion

centered around the <blockedmailto:[email-masked]>
question of whether or not a Kerberos security

model should be added <blockedmailto:[email-masked]>
to the existing set of security models.  At the

end of the meeting, <blockedmailto:[email-masked]>
which was attended by a relatively small number of

people, there was no <blockedmailto:[email-masked]>
consensus in the room as to whether or not the WG

should tak e on the <blockedmailto:[email-masked]>  os
security model. The

chairs have to <blockedmailto:[email-masked]>  address
the need and adoption issue with the mailing

list. For the (D)TLS <blockedmailto:[email-masked]>
transport of SNMP and related specifications,

interoperability <blockedmailto:[email-masked]>
testing is ongoing with the goal to advance the

specifications to <blockedmailto:[email-masked]>
Draft Standard.

 <blockedmailto:[email-masked]> 

/js <blockedmailto:[email-masked]> 

 <blockedmailto:[email-masked]> 

-- <blockedmailto:[email-masked]>  

Juergen Schoenwaelder <blockedmailto:[email-masked]>
Jacobs University Bremen gGmbH

Phone: +49 421 200 <blockedmailto:[email-masked]>
3587         Campus Ring 1, 28759 Bremen, Germany

Fax:  <blockedmailto:[email-masked]>   +49 421 200
3103    &nbs p;
href="blockedhttp://www.jacobs-university.de/">http://www.jacobs-university.
de/>

Isms mailing list

[email-masked]

https://www.ietf.org/mailman/listinfo/isms
<blockedhttps://www.ietf.org/mailman/listinfo/isms>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 16 Nov 2010 16:26:55 +0100

> computational load on the managed devices.

So do you plan to implement this? Or do you plan to deploy this?

/js

---

From: "Shorey, Robert Mr CTR USA USAASC USA" <[email-masked]>
Date: Tue, 16 Nov 2010 08:34:39 -0700

This concept is being examined for implementation on a prototype project
that is a risk reduction for a much larger project.

Rob Shorey
Mobile: (719) 321-4380

-----Original Message-----
From: Juergen Schoenwaelder [mailto:[email-masked]] 
Sent: Tuesday, November 16, 2010 8:27 AM
To: Shorey, Robert Mr CTR USA USAASC USA
Cc: [email-masked]
Subject: Re: [Isms] KSM for SNMPv3

On Tue, Nov 16, 2010 at 07:32:46AM -0700, Shorey, Robert Mr CTR USA USAASC

/js

---

From: "Pejaver, Rajaram" <[email-masked]>
Date: Tue, 16 Nov 2010 15:53:25 +0000

Rob,

We would like to understand the general requirements of your projects.
We are proposing KSM to secure SNMPv3 because none of the other proposals meet our requirements.
KSM is still in a nascent stage and comments for improvement would be appreciated.

Rajaram Pejaver, Comcast

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Shorey, Robert Mr CTR USA USAASC USA
Sent: Tuesday, November 16, 2010 10:35 AM
To: 'Juergen Schoenwaelder'
Cc: [email-masked]
Subject: Re: [Isms] KSM for SNMPv3

Rob Shorey
Mobile: (719) 321-4380

-----Original Message-----
From: Juergen Schoenwaelder [mailto:[email-masked]] 
Sent: Tuesday, November 16, 2010 8:27 AM
To: Shorey, Robert Mr CTR USA USAASC USA
Cc: [email-masked]
Subject: Re: [Isms] KSM for SNMPv3

/js

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 16 Nov 2010 17:01:18 +0100

> KSM is still in a nascent stage and comments for improvement would

In particular, it would be nice to know how notifications are supposed
to work with KSM. Note, access control is applied on the notification
sender side, based on the identity of the notification receiver.

/js

---

From: "Pejaver, Rajaram" <[email-masked]>
Date: Tue, 16 Nov 2010 16:29:41 +0000

JS> notifications are supposed to work with KSM.

Yes, this is on our list for addition to version 02 of the ID, along with other suggestions/comments received.
I hope you feel that there was improvement from -00 to -01, which was rushed out for China.
What do you think would be a reasonable timeframe for the completion of version 02?

regards

Rajaram Pejaver, Comcast

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 16 Nov 2010 17:41:39 +0100

On Tue, Nov 16, 2010 at 04:29:41PM +0000, Pejaver, Rajaram wrote:
 
> Yes, this is on our list for addition to version 02 of the ID, along
> with other suggestions/comments received.  I hope you feel that
> there was improvement from -00 to -01, which was rushed out for
> China.  What do you think would be a reasonable timeframe for the
> completion of version 02?

I have no idea how much time you can/want devote to this activity.
This is up to you to figure out. Speaking as technical contributor,
the question how notifications are handled is I believe the biggest
open technical issue.

/js