Re: [Isms] open issues

["David B. Nelson" <d.b.nelson at comcast.net>]

Randy Presuhn writes...

> Our architecture, both on the manager and on the agent ends,
> strongly assumes that security mechanisms are able to authenticate
> to the granularity of a principal.  RFC 3411 sections 3.2.1 and 3.2.2
> should make that clear.  If SSH doesn't provide (or can't be made to
> provide) that service, then it's not suitable.

The authentication inherent to SSH is asymmetric.  It was originally
designed to facilitate users logging into remote hosts.  An SSH client is
able (by various SSH Authentication Methods) to authenticate to an SSH
server at the granularity of a principal.  An SSH server authenticates to
the SSH client at the granularity of a host (i.e. the host identity of the
SSH server).

If you assume that the shared keys of USM are shared at the granularity of a
principal at both the agent and management station ends on an SNMP
connection, then USM provides symmetric authentication at the granularly of
a principal.

In order to provide authentication at the granularity of a principal in the
notification case for SSHTM, one would presumably require that the agent act
as an SSH client and present principal granularity credentials for
authentication by the SSH server, i.e. the management station.

The fly in the ointment here is that one of the primary reasons for having
SSHTM is to avoid the need to provision credentials (at principal
granularity) on all the managed entities in an organization.  In the case of
a management station sending SNMP commands to an agent, we assume that the
management station application, or the user invoking that application, has
an identity that can be validated via some method such as AAA, at the agent.
That identity may become from some non-volatile configuration store, or it
may come from the user's login credentials.  I think that the latter case is
more common.

It is perfectly possible to provision device credentials in the non-volatile
configuration store of the managed entities (notification generators) if you
are willing to experience USM-like scaling properties.

_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms