Re: [Isms] pre11 comments

[Wes Hardaker <wjhns1 at hardakers.net>]

>>>>> On Thu, 3 Jul 2008 18:40:20 -0400, "David B. Nelson" <dnelson at elbrysnetworks.com> said:

>> This all means that *if* we want to allow separate authorization
>> levels for different secure transports (and I'll argue that we
>> do want to)...

DBN> Well, yeah, but where do we stop?

Right now the VACM and the security model can be used together to grant
or deny access based on a particular security model.  With a generic
"any sub-transport will do" security model not being put in place (TSM)
then we loose that ability.  I'm not trying to gain ground by doing
cipher-suite selection (that can still be left up to the individual
transport model's configuration since it's very specific to it).  What I
do think we're loosing, though, is the ability to select an
authorization set based on the protocol being used itself (like we used
be able to select between USM and KSM).  I don't think we should go
further than that, because further than that wasn't ever in the original
SNMPv3 architecture either.

-- 
Wes Hardaker
Sparta, Inc.
_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms