Re: [Isms] #19: should RADIUS be exposed outside of SSH?

[Eliot Lear <lear at cisco.com>]

Nelson, David wrote:
> > Subject: [Isms] #19: should RADIUS be exposed outside of SSH?
> One point that hasn't had much [any] discussion is that AAA services
> such as RADIUS and Diameter are designed to provision a specific
> service, such as packet forwarding or telnet terminal services.  I
> believe that AAA should provision SNMP management access as a specific
> service, and therefore a RADIUS authorization for SNMP access should not
> be capable of being used for packet forwarding services (or visa versa).
> This is another level of authorization that would need to be exposed
> beyond SSH.

We should be very careful how we do this.  We do not want to tie SSHSM 
to radius or diameter.  In order to even determine this prior to 
authentication (the specific SNMP subsystem request is made *after* 
authentication) it seems to me that a separate port is required.

Eliot

_______________________________________________
Isms mailing list
Isms at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms