Re: [Isms] ISMS/SSH and notifications

[Wes Hardaker <wjhns1 at hardakers.net>]

>>>>> On Wed, 14 May 2008 12:02:35 -0400, Jeffrey Hutzelman <jhutz at cmu.edu> said:

JH> Please drop right now any notion that SNMP should track, identify, or
JH> authorize any engine based on SSH public keys.

I never said that directly (well, I probably implied it).  What I said
was that the client has to know the credentials of the other side in
order to protect against mitm attacks.  The client will have to specify
somehow which remote authentication mechanisms and credentials are
trusted.  To not do this would be to blindly allow ssh to always
perform a leap of faith which is very insecure and prone to mitm issues.

JH> To do so would be a serious abstraction violation and would defeat
JH> or seriously impair the purpose of ISMS, which is to allow operators
JH> to authenticate SNMP using their existing infrastructure.

This may well be done through existing known hosts and key material.

-- 
Wes Hardaker
Sparta, Inc.
_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms