Subject: RE: [Isms] SSH vs SNMP concepts

From: "Martin Soukup" <[email-masked]>
Date: Tue, 6 Sep 2005 09:02:15 -0400

In the case of OpenSSH, at least, multiple keys can also be specified.
>From the man pages for "SSH_KNOWN_HOSTS FILE FORMAT":

"When performing host authentication, authentication is accepted if any
matching line has the proper key.  It is thus permissible (but not
recom-
mended) to have several lines or different host keys for the same names.
This will inevitably happen when short forms of host names from
different
domains are put in the file."

E.g.:

Ismsagent	PUB-KEY1
Ismsagent	PUB-KEY2

Alternatively, an implementation could require hosts with multiple
agents to have multiple names, but that sounds messier.

Martin.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of David T. Perkins
Sent: Saturday, September 03, 2005 8:54 PM
To: Randy Presuhn
Cc: [email-masked]
Subject: Re: [Isms] SSH vs SNMP concepts

HI,

Randy, yes it does look like an "implementation" rather than
a "protocol" limitation. However, the goal of the WG is to
use existing security infrastructure. The ssh_hosts file
on client machines is part of a client's existing security
infrastructure. So, given that limitation (no port, that is, only a
network address), how would you solve the problem of supporting multiple
independent SNMP agents on a system?

Well, one pretty straight forward approach is what
has been done to support v1 managers, but one the other end. That is 
 1) use SNMPv3/ISMS-SSH between a command generator
    (management app) and command responder (agent)
    which are located on different systems.
 2) have the SNMPv3/ISMS-SSH agent serve as a proxy
    (or encapsulating) agent to the independent
    SNNPv1/v2c/v3USM agents via a loopback address.

On Sat, 3 Sep 2005, Randy Presuhn wrote
> Hi -
> 
> > From: "Robert Story" <[email-masked]>
> > To: <[email-masked]>
> > Cc: <[email-masked]>
> > Sent: Friday, September 02, 2005 10:49 AM
> > Subject: Re: [Isms] SSH vs SNMP concepts
> >
> 
> > On Tue, 30 Aug 2005 10:24:59 -0400 David wrote:
> > DBH> The question asked was about whether SSH had a mechanism that 
> > DBH> would allow us to mirror a specific SNMP capability - "If 
> > DBH> multiple SSH servers or multiple SSH clients exist on the same 
> > DBH> host, how would one differentiate them? Is this standardized?"
> >
> > Peeking at the OpenSSH sshd man page, it looks like the host key and

> > port can both be specified on the command line. However, when the 
> > client stores known host keys, the port is not stored, so the client

> > will cry foul when connecting to a second server on the same host 
> > with a different host key.
> ...
> 
> This sounds like an implementation problem, rather than a protocol 
> issue.
> 
> Randy

Enjoy,
/david t. perkins

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms