Subject: Re: [Isms] SSH vs SNMP concepts

From: Robert Story <[email-masked]>
Date: Fri, 2 Sep 2005 13:49:47 -0400

On Tue, 30 Aug 2005 10:24:59 -0400 David wrote:
DBH> The question asked was about whether SSH had a mechanism that would
DBH> allow us to mirror a specific SNMP capability - "If multiple SSH
DBH> servers or multiple SSH clients exist on the 
DBH> same host, how would one differentiate them? Is this standardized?"

Peeking at the OpenSSH sshd man page, it looks like the host key and port can
both be specified on the command line. However, when the client stores known
host keys, the port is not stored, so the client will cry foul when connecting
to a second server on the same host with a different host key.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David T. Perkins" <[email-masked]>
Date: Fri, 2 Sep 2005 12:19:36 -0700 (PDT)

HI,

Thanks for reexamining the MAN pages.
Are you saying that the client can specify the host key on
the command line, or just the server.

If client, sorry I missed that option. Also, I didn't spot
such an option on other SSH implementations such as putty
and teraterm (with the ttssh addin). Both allow you
to specify the port to use on connect, so you can
communicate with multiple SSH servers on the same
IP address (each with a different port).

I couldn't figure out what DBH meant by "differentiating SSH
clients", and sent him a private message for which I haven't
yet gotten a response.

> to a second server on the same host with a different host key.
Regards,
/david t. perkins

---

From: "Randy Presuhn" <[email-masked]>
Date: Sat, 3 Sep 2005 14:48:14 -0700

Hi -

> From: "Robert Story" <[email-masked]>
> To: <[email-masked]>
> Cc: <[email-masked]>
> Sent: Friday, September 02, 2005 10:49 AM
> Subject: Re: [Isms] SSH vs SNMP concepts
>

> to a second server on the same host with a different host key.
...

This sounds like an implementation problem, rather than a protocol issue.

Randy

---

From: "David T. Perkins" <[email-masked]>
Date: Sat, 3 Sep 2005 17:53:42 -0700 (PDT)

HI,

Randy, yes it does look like an "implementation" rather than
a "protocol" limitation. However, the goal of the WG is to
use existing security infrastructure. The ssh_hosts file
on client machines is part of a client's existing security
infrastructure. So, given that limitation (no port, that
is, only a network address), how would you solve the problem
of supporting multiple independent SNMP agents on a
system?

Well, one pretty straight forward approach is what
has been done to support v1 managers, but one the other end.
That is 
 1) use SNMPv3/ISMS-SSH between a command generator
    (management app) and command responder (agent)
    which are located on different systems.
 2) have the SNMPv3/ISMS-SSH agent serve as a proxy
    (or encapsulating) agent to the independent
    SNNPv1/v2c/v3USM agents via a loopback address.

On Sat, 3 Sep 2005, Randy Presuhn wrote
> This sounds like an implementation problem, rather than a protocol issue.

Enjoy,
/david t. perkins