Subject: Re: [Isms] FW: New Version Notificationfordraft-pejaver-isms-kerberos-01

From: "David Harrington" <[email-masked]>
Date: Fri, 5 Nov 2010 09:59:00 +0800

I needed, the Responsible AD might be able to add text using an RFC
Editor note.
If this changes the security properties, however, he'd probably need
to pull it back, do another IETF Last Call and another IESG review.
Dan may have other ideas of how to handle it.
If you want chnages, now is better than later.

dbh 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Randy Presuhn
> Sent: Thursday, October 28, 2010 3:32 AM
> To: [email-masked]
> Subject: Re: [Isms] FW: New Version 
> Notificationfordraft-pejaver-isms-kerberos-01
> 
> Hi -
> 
> > From: "Lee, Yiu" <[email-masked]>
> > To: "David B. Nelson" <[email-masked]>; "Pejaver, 
> Rajaram" <[email-masked]>
> > Cc: <[email-masked]>
> > Sent: Wednesday, October 27, 2010 9:32 AM
> > Subject: Re: [Isms] FW: New Version Notification 
> fordraft-pejaver-isms-kerberos-01
> ...
> > We are indeed trying to use the AAA-VACM model. We are 
> still investigating
> > it. If this is workable, we will suggest some text in the 
> AAA-VACM draft.
> ...
> 
> I asked for input specifically with respect to the Kerberos 
> work quite some
> time ago.
> 
> The AAA-VACM document is now in the RFC editor queue, so it's
> really too late for change proposals.  If you think a change would
be
> necessary, then I guess the path to take would be to add a bis
> effort to this WG's charter.
> 
> Randy
> 
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/isms

---

From: "Lee, Yiu" <[email-masked]>
Date: Fri, 5 Nov 2010 14:36:23 +0000

We did some investigation. So far we believe we can use the same AAA-VACM
model for KSM. Basically, the SNMP message from Command Generator will
contain the ksmSecurityParameters which contains the groupName and
securityName. The Command Responder will create the vacmSecurityToGroup
table and call isAccessAllowed.

---

From: "t.petch" <[email-masked]>
Date: Fri, 5 Nov 2010 14:42:21 +0100

I think that this latest proposal demonstrates why it would be foolish to
retrieve a document from the RFC Editor queue to try and add, in haste,
a technical change which could have been done at leisure during this
summer.

Or perhaps I have never noticed the ASIs that allow a Command
Generator to update the VACM MIB Module.

Tom Petch

----- Original Message -----
From: "Lee, Yiu" <[email-masked]>
To: "David Harrington" <[email-masked]>; "'Randy Presuhn'"
<[email-masked]>; <[email-masked]>
Sent: Friday, November 05, 2010 3:36 PM
Subject: Re: [Isms] FW: New Version
Notificationfordraft-pejaver-isms-kerberos-01