Subject: RE: [Isms] Questions for Call home

From: [email-masked]
Date: Fri, 16 Sep 2005 09:59:50 -0700

My previous statement had some ambiguity. Here is a second try

I think we need to keep in mind RFC3411 when we talk about identity. The
role of ISMS is to provide flexible authentication and key management
without modifying the notion of identity within RFC3411. From a security
perspective the only identity RFC3411 deals with is the securityName,
i.e. SNMP principal (SNMP engine ID is really not authenticated). What
the means is that irrespective of the SNMP engine that initiates the
conversation (CH or otherwise), any command generators and notification
generators which generates/sends a message in the conversation MUST
authenticate using SNMP securityName (using the SSH user authentication
protocol)

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Kaushik Narayan [[email-masked]]
Sent: Friday, September 16, 2005 9:22 AM
To: [email-masked]; Eliot Lear
Cc: [email-masked]
Subject: RE: [Isms] Questions for Call home

Hi Juergen, Eliot,

I think we need to keep in mind the SNMPv3/USM model when we talk about
identity. The role of ISMS is to provide flexible authentication and key
management without modifying the notion of identity within USM. From a
security perspective the only identity USM deals with is the
securityName, i.e. SNMP principal (SNMP engine ID is really not
authenticated). What the means is that irrespective of the SNMP engine
that initiates the conversation (CH or otherwise), command generators
and notification generators MUST authenticate using SNMP securityName(
using the SSH user authentication protocol)

Regards,
  kaushik!

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Juergen Schoenwaelder
Sent: Friday, September 16, 2005 2:11 AM
To: Eliot Lear
Cc: [email-masked]
Subject: Re: [Isms] Questions for Call home

On Fri, Sep 16, 2005 at 10:13:28AM +0200, Eliot Lear wrote:

> You asked a bunch of questions relating to CH.  Please see below:
> 
> > 1) What identities and credentials are being used?
> 
> Borrowing from BEEP terminology for the moment, the initiator and 
> listener will use any authentication mechanism supported by the 
> underlying mapping protocol.  That is to say, for SSH, the responder 
> is configured to authenticate to the command generator via an 
> appropriate SSH mechanism such as a user name and password.  The 
> generator would authenticate via a host key or other mechanism defined
with SSH.

So you are saying that for CH, the entity with the command generator you
have to authenticate the user identity, that is the "agent" logs into
the "manager" by sending a user identity and a password. So how does the
agent then later on when the "manager" sends a request do the access
control decision? As far as I can tell, the "agent" does not really have
an authenticated securityName - the only thing the "agent"
has is an authenticated host identity.

Can you explain how you envision to resolve this?

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen,
Germany

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 16 Sep 2005 13:54:46 -0400

Hi,

I'm not sure I agree with your statement.

Your last sentence says "MUST authenticate using SNMP securityName. I
believe that is incorrect. It is acceptable to have a mapping from the
SNMP securityName to a model-specific identity, and to perform the
authentication using the model-specific identity.

One way to change your statement would be to say "MUST authenticate
SNMP securityName". 

dbh 

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of [email-masked]
> Sent: Friday, September 16, 2005 1:00 PM

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 16 Sep 2005 15:38:12 -0400

Hi,

1) I have a concern with statements that certain types of applications
must authenticate. I don't believe that is an architectural
requirement, but more a factor of the way USM works. I believe a new
security model could do things differently, and new applications could
be written that had different requirements for authentication. 

2) It is incorrect to say that "any command generators and
notification generators which generates/sends a message in the
conversation MUST authenticate" - SNMPv3 also supports noAuthNoPriv.

dbh