Re: [Isms] ISMS/SSH and notifications

[Jeffrey Hutzelman <jhutz at cmu.edu>]

--On Tuesday, May 13, 2008 02:11:50 PM -0700 Wes Hardaker 
<wjhns1 at hardakers.net> wrote:

>>>>>> On Tue, 13 May 2008 16:32:18 +0200, "tom.petch"
>>>>>> <cfinss at dial.pipex.com> said:
> tp> And as has been pointed out several times, when the NO originates
> tp> the session, and the NO is the ssh client, then that credential is a
> tp> public key.
>
> The *client* credential is a public key.  As is the servers.

Not necessarily.  SSH supports key exchange methods in which the server is 
authenticated by a mechanism other than a public key, as well as methods in 
which public key crypto is used, but the server is not identified by a 
specific public key.  It also supports a wide range of user authentication 
methods which are not based on public keys.

Please drop right now any notion that SNMP should track, identify, or 
authorize any engine based on SSH public keys.  To do so would be a serious 
abstraction violation and would defeat or seriously impair the purpose of 
ISMS, which is to allow operators to authenticate SNMP using their existing 
infrastructure.

-- Jeff
_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms