Re: [Isms] Moving into some design / architecture issues of Extended VACM

[kaushik <kaushik at cisco.com>]

Hi Randy,

Please find my reply inline.

<snipped>

>> (2) if one does not already exist, a corresponding entry is created
>> in the vacmSecurityToGroupTable.
> 
> That, I think, is a potential security hole that you could drive a whole
> fleet of trucks through.  Creating a table entry with some default, null or
> wildcard set of access control rules seems like a very bad idea.  It's good
> for ease-of-use, but bad for security.
> 
> 

<Kaushik> 

The issue I have with this model is that we are using the RADIUS
user-to-group mapping which is a temporal association valid for the duration
of the session and provisioning a persistent piece of configuration on the
SNMP engine. I am not sure the semantics match and this could create
potential problems around whether the RADIUS server or SNMP engine is
authoritative source for user-to-group mapping since entries can be added to
the vacmSecurityToGroupTable without knowledge of the RADIUS server.

Regards,
 kaushik

</Kaushik>