Subject: RE: [Isms] What granularity of attributes do we need for the secure transport?

From: "Bernard Aboba" <[email-masked]>
Date: Fri, 4 Apr 2008 11:46:11 -0700

David Nelson spoke thusly:

"My question is whether this sort of configuration of the secure transport
protocol is something that needs to be checked by the NAS, using differing
criteria, on each and every user authentication?  I think that granularity
of configuration is generally handled by, well... configuration, and not
handled as part of user authorization."

With respect to IEEE 802.11 access, there are no RADIUS attributes that 
specify whether a given user is allowed to do WEP/WPA/WPA2.  It is 
assumed that security is negotiated between the AP and STA based on 
their configuration.  This seems to work OK, particularly
since separate SSIDs are typically provisioned for each supported security 
mechanism, so that user authorization can be handled based on the
SSID (provided in the Called-Station-Id).   

A similar approach might well work here -- we assume that the NAS is set 
up to allow/require various security mechanisms.  It might be useful for
the NAS to tell the RADIUS server what security mechanism has been
negotiated, and the RADIUS server might Accept/Reject the authentication
based on that information as well as the user-name.  But there is no
notion that the RADIUS server can exercise *control* over what is 
negotiated -- it is "here is what I'm doing, take it or leave it". 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>

---

From: "David B. Nelson" <[email-masked]>
Date: Fri, 4 Apr 2008 14:56:49 -0400

There is a discussion going on currently in the ISMS WG with regard to
authorization and/or provisioning of management access to a NAS,
specifically with respect to the security properties of the transport
protocol (for remote management).  Some of this discussion has been specific
to SNMP and the ISMS work, but some is more generally related to NAS
management authorization.

I'll forward (cross-post) those messages of general interest to RADEXT.  You
may also review the ISMS WG mailing list archives for additional
information. 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> David B. Nelson
> Sent: Friday, April 04, 2008 1:57 PM
> To: [email-masked]
> Subject: Re: [Isms] What granularity of attributes do we need for the
> secure transport?
> 
> David Harrington writes...
> 
> > I do not believe we need to provision the security protocol; ...
> 
> Meaning we don't need to specify such things as the selection of optional
> modes, cipher suite, authentication mechanism, certificate chains, and so
> forth.  Right?
> 
> > I think we should allow an operator to decide which secure transport
> > they want to require as a condition of granting access to the SNMP
> > service.
> 
> Just the transport protocol name?  Or do you want to sub-specify versions,
> e.g. SSHv2, TLSv1?  If you want to specify IPsec as one of these, do you
> need to specify such things as IKEv2?
> 
> I think the devil is in the details.
> 
> If I understand your position correctly, to want to augment the existing
> Management-Protocol-Protection attribute, which specifies the level of
> security in an abstract fashion, with a reinstated
> Management-Transport-Protocol attribute which names the mandated protocol
> (and maybe the protocol version).  Right?  Do you anticipate that there
> could be only one of these attributes in a RADIUS Access-Accept message,
> or could there be more than one (i.e. acceptable alternatives)?
> 
> That seems to be a middle ground choice, between having only an abstract
> assertion about the security level and having all the details and
> parameters
> related to a secure transport protocol.
> 
> What do others think about this decision point?
> 
> -- Do we need only an abstract security level assertion?
> 
> -- Do we need the transport protocol name?
> 
> -- Do we need the transport protocol version?
> 
> -- Do we need any further details of security parameters?
> 
> _______________________________________________
> Isms mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/isms

---

From: "David B. Nelson" <[email-masked]>
Date: Fri, 4 Apr 2008 14:57:53 -0400

> From: Juergen Schoenwaelder [mailto:[email-masked]]
> Sent: Friday, April 04, 2008 2:47 PM
> To: David B. Nelson
> Cc: [email-masked]
> Subject: Re: [Isms] What granularity of attributes do we need for
> the secure transport?
> 
> On Fri, Apr 04, 2008 at 01:57:27PM -0400, David B. Nelson wrote:
> 
> As technical contributor, I like the abstract security level
> assertion. More granular control can be achieved by means of
> configuration of the SNMP engine or secure transport protocol.
> 
> /js
> 
> --
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
> Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>