Subject: [Isms] RE: Some text on identity and authentication for SSHSM

From: [email-masked]
Date: Fri, 16 Sep 2005 20:15:02 -0700

Hi David,
 
I have not gone through the entire text but Section 2.1 seems the most
appropriate place for most of
the Identity and Authentication. 
 
regards,
  kaushik!

________________________________

From: David B Harrington [mailto:[email-masked]] 
Sent: Friday, September 16, 2005 7:53 PM
To: Kaushik Narayan [[email-masked]]; [email-masked];
Joseph Salowey [[email-masked]]
Cc: [email-masked]
Subject: RE: Some text on identity and authentication for SSHSM

Hi Kaushik,
 
Where in the document is your text meant to go?
Please provide the revision and the section numbers so I know where you
intend it to go.
 
dbh

________________________________

	From: [email-masked] [mailto:[email-masked]] 
	Sent: Friday, September 16, 2005 10:41 PM
	To: [email-masked]; [email-masked];
[email-masked]
	Cc: [email-masked]
	Subject: Some text on identity and authentication for SSHSM

	Hi Dave, Juergen, Joe,
	 
	Please find some text in the attached document pertaining to
identity and authentication with SSHSM.
	 
	regards,
	  kaushik!

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: [email-masked]
Date: Tue, 20 Sep 2005 14:40:41 -0700

Hi Juergen,

Please find my reply inline. 

> 
> I think this text is not very clear. Fundamentally without X.509 
> certificate support for user authentication you would need 
> identity/public keys to be manually provisioned on SNMP engines (that 
> act SSH servers)to authenticate requests that use the "publickey"
> method, i.e. agents will need to be provisioned identity/public key in

> order to authenticate managers that might use publickey method of SSH 
> user authentication. If these keys are not already provisioned to be 
> used by NetConf/CLI (over SSH), then having to provision these keys 
> for use within SNMP actually has the same issues as SNMPv3/USM. The 
> text intends to state that without X.509 support, the "publickey" 
> method of SSH user authentication is not preferred unless it is 
> already in  use by other management protocols such as NetConf that use
SSH transport.
> </Kaushik>

I believe the document should specify how the SSHSM works but not
include best current practice usage guidelines or applicability
statements. I have the feeling that we currently mix all these things
together. There might be operators who find it easier to administrate
SSH public keys compared to SNMPv3/USM keys and I believe we should let
operators make such decisions. So I am fine with a statement that
highlights that SNMP over SSH can leverage keys installed for other
management purposes - I dislike statements which say "you should not use
SNMP over SSH if you have to install public keys for this purpose and no
other management access mechanism. The later sounds like a CLR to me.

<Kaushik>

That's a fair comment. I will remove that sentence.