Re: [Isms] #8: Do we need a mapping between the SSH key and SNMPengineID?

[Sam Hartman <hartmans-ietf at mit.edu>]

>>>>> "Blumenthal," == Blumenthal, Uri <uri.blumenthal at intel.com> writes:

    Blumenthal,> This implies that different engines should have
    Blumenthal,> different public keys.  Otherwise from security point
    Blumenthal,> of view only one SNMP engine will be allowed on one
    Blumenthal,> SSH host.

I don't follow because as you point out:

    Blumenthal,> An alternative: all the security will depend on "SSH
    Blumenthal,> layer" - something responsible for all the SSH
    Blumenthal,> communications of this host, and multiplexing traffic
    Blumenthal,> between various services that use SSH for protection.

right.  In this model, you need a name to address PDUs to the snmp
engines, but the security binding is handled at the ssh layer.


_______________________________________________
Isms mailing list
Isms at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms