Subject: Re: VACM and DISMAN

From: Uri Blumenthal <[email-masked]>
Date: Mon, 20 Jul 1998 22:31:39 -0400 (EDT)

Juergen Schoenwaelder says:
> .......I also have concerns that management applications will provide
> the support necessary to make this work in practice (that is providing
> the intelligence to automatically select the "right" identities). 

It is hardly possible [meaning that a correctly working and properly
secure management application that fits the bill isn't likely to be
created.]

> The lesson I have learned from party-based SNMPv2 is that the stuff has
> to be damn simple to use and that we should not rely on assistance from
> tools to get the thing configured and running.

Can't agree more.
-- 
Regards,
Uri		[email-masked]
-=-=-=-=-=-=-
<Disclaimer>

---

From: "Mike O'Dell" <[email-masked]>
Date: Tue, 21 Jul 1998 07:22:04 -0400

doing roll-based authentication is trivial - the user authenticates
FOR A SPECIFIC ROLE and then does his work under that guise.  there
is no magic required whereby the software has to "guess" what roll
is required.  there is an absolute declaration of intent by the 
human.

jeez - why are you guys trying to hard to fail??

	-mo

---

From: Uri Blumenthal <[email-masked]>
Date: Tue, 21 Jul 1998 12:40:33 -0400 (EDT)

Mike O'Dell says:
> FOR A SPECIFIC ROLE and then does his work under that guise.  

The *concept* is trivial. The implementation is not, and neither are
the details.

Plus, what you seem to mean is *not* a "true" role-based approach.
A "true" one requires a combination of principal rights with role
rights. What you seem to imply is  "authenticate the principal,
use the rights of the `role'".

Oh, and of course one needs a "permissions" table - which principal
is authorized for which roles (and maybe this table should include
date/time restrictions?).

It is simple until you start thinking about how people will use it,
how crackers will try to break it, and what it is supposed to
protect you from...

[Now back to my jet-lagged uneasy sleep, going "barrel rolls" :-]

> there is no magic required whereby the software has to "guess" what
> roll is required. there is an absolute declaration of intent by the 
> human.

No magic, just (a) inclusion of the role name/tag in the message and
(b) decision on how to compute the access rights [to base it solely
on the role "rights", or on a combination of the role "rights" and 
the user "rights"].

I wish you'd commented on that rather than on the triviality of the
basic concept...
-- 
Regards,
Uri		[email-masked]
-=-=-=-=-=-=-
<Disclaimer>

---

From: "Mike O'Dell" <[email-masked]>
Date: Tue, 21 Jul 1998 13:38:02 -0400

Uri, i've been doing OS security since the early 1970s - i don't need
the lecture.

you can complicate the model to the degree you wish and i'm not going
to argue about what constitutes "true" role-based security.  arguments
like that produced the SNMPv2 success.

suffice it to say that we firmly believe that the authentication and
authorization capabilities we need to operate a network of over 10,000
network elements and over half a billion US$ in cost, using a
"role-inspired" model, can be implemented at reasonable cost and
complexity using a combination of machinery resident in the network
elements and some resident in the management software infrastructure,
all using SNMPv3 mechanics as currently described.

now can we please just ship the damn thing so we can get on with
running our network??

	-mo

---

From: Uri Blumenthal <[email-masked]>
Date: Tue, 21 Jul 1998 14:30:31 -0400 (EDT)

> Uri, i've been doing OS security since the early 1970s - i don't need

OK, I'm glad to finally find somebody who knows it all.

But since I don't know it all, and in the early 70s I've been doing
other things - it would be helpful if you answered the purely
technical questions I asked. Besides, you can't expect a
consistent reaction unless those questions are answered
uniformly by every implementation. I hope it is clear?

> like that produced the SNMPv2 success.

I'm trying to figure out what the hell it is that you want, and to
possibly map it onto terminology that other people use/ That's all.

> all using SNMPv3 mechanics as currently described.

Fine with me - especially if instead of this pointless and non-technical
bickering you take 5 minutes to understand the technical questions I've
been asking and another 5 minutes to answer them.

> now can we please just ship the damn thing so we can get on with

Who stops you from shipping "the damn thing"? Not me, I hope?
-- 
Regards,
Uri		[email-masked]
-=-=-=-=-=-=-
<Disclaimer>

---

From: Fred Engel <[email-masked]>
Date: Wed, 22 Jul 1998 08:28:08 -0400

Guys, let's not get personal :-)!!

Fred

>Who stops you from shipping "the damn thing"? Not me, I hope?
Fred Engel
Vice President, Engineering
Concord Communications, Inc.
Marlboro, MA. 01752
(508)-460-4646