Re: [Isms] Moving into some design / architecture issues ofExtended VACM

[Juergen Schoenwaelder <j.schoenwaelder at jacobs-university.de>]

On Tue, Jun 16, 2009 at 02:53:57AM +0200, Randy Presuhn wrote:
> 
> I think it has a real problem from the perspective of security configuration
> management.  A security administrator should be able to find out how
> a system's security policy is configured, regardless of whether RADIUS
> is in use.  This means the "shadow" table would need to be visible to
> management.  However, the security administrator should also be able
> to configure and update the "real" VACM configuration whether RADIUS
> is in use at the moment or not.  This means that "write" operations
> would need to affect both the shadow and the "real" configuration.
> However, to determine whether the "real" configuration is in need of
> update, it must be possible for the administrator to retrieve it.  This
> conflict is irreconcilable.
> 
> To kluge around it, I think you'd have to use a separate SNMP context for the
> shadow.  This is just too ugly and convoluted a thing to do for no real
> benefit, particularly since it would require standardizing a context name
> for this kluge.

I do not think you need to mess around with contexts. If we can make
multiple ACMs to work, the problem has a solution.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>