Re: [Isms] wg last call followup - sshtm
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Isms] wg last call followup - sshtm



--On Saturday, February 28, 2009 08:45:09 PM +0100 "tom.petch" <cfinss at dial.pipex.com> wrote:

I am still struggling with the 'Pasi problem' that he raised last
November and although I recall seeing a message from him that he was
satisfied, I cannot understand how it works in the current I-Ds; I cannot
understand part of the I-Ds so tell me first what is meant to happen.

Suppose securityName is alice and transport address is bob at example.com:ssh
in a Command Generator.

For a Request, sshtm passes bob to SSH and that is used for the session
setup as per s5.3 3 1.  The Command Responder uses bob for access control
etc.  The response will come back, SSH will pass a name of bob (s5.1 2)
to stm as a securityName via tmStateReference which will pass it on to
tsm which may or may not prefix it (s5.2 3) and then it will get passed
to the application.

So the application specified alice and got back bob.

Is this how it is meant to work?

That won't happen. In your scenario, the CR does not "use bob for access control". TSM compares the name reported by SSH (bob) with the securityName in the SNMP message, and when they don't match, rejects the request.

-- Jeff

Note: Messages sent to this list are the opinions of the senders and do not imply endorsement by the IETF.