[Isms] Proposed SSH Transport Address Changes (and a quick nit)

[Wes Hardaker <wjhns1 at hardakers.net>]

I promised David a while ago to write this thought up...  I'm a bit late
in getting it out the door though.

Current the SnmpSSHAddress TC offers flexible support to accommodate a
name, a v4 address and a v6 address (surrounded by brackets) and by a
port number.  Thus the following values are legal:

  127.0.0.1:161
  host.example.com:161
  [::1]:161

(if I read everything correctly).

First, a quick issue: (which will be new to you Dave since I noticed it
after our discussion) is that the text about IPv6 says "surrounded by
brackets" which is not deterministic since there are two types of
brackets.  I assume you mean square brackets, because that's common
usage, but it should be spelled out (maybe using the ASCII character
numbers 0x5B and 0x5D like you did for the colon).


Second, SSH has a fairly common usage that allows one user on one host to
connect as a different user on the remote host.  Right now in the SSHSM
solution it's not possible to use a different remote user than the one
specified locally even though this is common usage within SSH users
today.

To fix this, I'd like to suggest another *optional* portion on the front
of the string that allows specifying the SSH user name to be used.
Specifically, the "@" sign (ASCII 0x40) in the address string would be a
delimiter to indicate that the beginning portion is a user name.  The @
symbol don't exist legally in the existing specification so it shouldn't
conflict with the existing structure and is easy to quickly look for and
parse out.  (and it is already common usage within at least some SSH
implementations).

Thus a transport address might look like these (in addition to the above
still being legal):

  wes at 127.0.0.1:161
  wes at host.example.com:161
  wes at [::1]:161


What's the benefit?
----------------------------------------

A separation of the local securityName from the remote user used to
authenticate to the remote connection.  SSH users use this all the time
because their local identity name is different than the remote (I'm
"hardaker" on my local system, but "whardaker" on others).  From an SNMP
standpoint, I could use a single local username to do VACM and other local
information checks ("hardaker") but ssh-login to the remote site using
different names as needed and specified by the transport address.  The
only thing this affects is the SSH transport that uses the address
string.  And because some SSH stacks already support this, it's possible
they can still just pass the string along as is.  Operators already
understand the usage (and may expect that it'd work).

-- 
Wes Hardaker
Sparta, Inc.
_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms