Re: [Isms] open issues

[Juergen Schoenwaelder <j.schoenwaelder at jacobs-university.de>]

On Wed, Apr 23, 2008 at 01:28:53AM -0600, Randy Presuhn wrote:
 
> So if the manager is an SSH server as far as notification streams
> are concerned, I think things work out about as well as they do with
> USM (if one has configured USM to not be vulnerable to the potential
> compromise of an agent system.)  Specifically, it means that for a 
> notification user, a separate securityName would need to be created
> for each manager/agent pair.  (Otherwise one agent could impersonate
> another.) Though the access control policy is applied on the agent,
> that securityName is also what would be needed to establish the
> SSH connection with whatever manager is to be used as the trap
> destination, thus giving the desired authentication, or at least as
> much authentication as a manger gets when it sends configuration
> data to an agent.

But if the manager is the SSH server, then all you have is an
authenticated host the server is running on. You made the point that
there can be distinct notification receivers on the same host. So how
do you solve that puzzle?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms