Subject: Re: [Isms] One clarification

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 10 Nov 2010 14:43:46 -0500

--On Wednesday, November 10, 2010 01:46:27 PM +0000 "Lee, Yiu" 
<[email-masked]> wrote:

> It doesn't compete with the current isms work because
> some ISP may decide to use SSH and some may decide to use Kerberos.

Well, no.  The point of selecting SSH was to allow for use of a variety of 
existing authentication infrastructures without having to define new SNMP 
security models for each one.  It is certainly possible to use Kerberos to 
authenticate both the SSH client and server, and to use such a 
configuration with TSM and SSHTM.  As co-chair of the Kerberos working 
group and one of the authors of the SSH GSS-API extensions, this was one of 
my goals when I became involved in the ISMS work.

So, "some people might want to use Kerberos instead of SSH" is not an 
argument for pursuing this work.  Such sites can use Kerberos _with_ SSH 
under the existing specifications.  Using Kerbers "instead of SSH" is 
nonsensical.

My understanding from previous discussion was that your motivation for this 
work is that you wish to use UDP instead of SSH, due to some belief that 
monitoring large numbers of devices would require maintaining large numbers 
of SSH and TCP connections, and that doing so is infeasible.

I think you need to be clear about the justification for this work, because 
I for one am willing to entertain some arguments for having multiple ways 
to do something, but not others.

-- Jeff

---

From: "Pejaver, Rajaram" <[email-masked]>
Date: Wed, 10 Nov 2010 20:07:15 +0000

Yiu probably meant to say: Some ISPs may decide to use
"SSH transport model + RADIUS (or Kerberos)" and some may decide to use "UDP + KSM".

At least that's how I interpreted it when I read it.
And I am sure I am not being completely precise either.

--raj

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jeffrey Hutzelman
Sent: Wednesday, November 10, 2010 2:44 PM
To: Lee, Yiu; [email-masked]
Cc: [email-masked]
Subject: Re: [Isms] One clarification

-- Jeff
_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms