Re: [Isms] ISMS/SSH and notifications

[Wes Hardaker <wjhns1 at hardakers.net>]

>>>>> On Mon, 5 May 2008 16:17:56 +0300, <Pasi.Eronen at nokia.com> said:

PE> Is there any precedent for this, e.g. other MIBs that manage
PE> public keys in some way? Or generate new keys?

As Randy mentioned, yes.

The USM-DH MIB also has some prior history.

>> Though we could also just opt-out of the whole configuration pile
>> and say "use this public key; you'd better have the private
>> somewhere in your ssh stash" (and a SET of an unknown public key
>> would then fail with an error).

PE> Or to make it more admin-friendly, maybe just pass a name/token of
PE> some kind; the SSH stash would be responsible for handling both 
PE> public and private parts of the key?

The problem with that is that the current SSH implementations don't
support named keys at this point.  Not that it can't be done, but it'd
require new features of the SSH service or an independent name mapping
on the SNMP side.

>> For a user-server connection the security name could be pulled from
>> the normal SSH connection.  That's already taken care of.  

PE> Well... the SSH user name seen by the notification receiver (SSH
PE> server) really identifies the notification generator, so it's not 
PE> the same as the securityName given by the notification generator
PE> application. If we want to preserve this property, we need something
PE> else...

I'm not sure which property you're talking about preserving.  (USM
actually operates in one of two modes depending on whether TRAPs or
INFORMs are being sent).
-- 
Wes Hardaker
Sparta, Inc.
_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms