Re: [Isms] pre11 comments

["David Harrington" <ietfdbh at comcast.net>]

Hi Wes,

I don't think VACM is designed to operate differently based on the
security protocol. It is designed to operate differently based on the
asserted securityLevel. Depending on the assertion made by the
security model rather than an assessment of the presumed strength of
the underlying security protocol was a deliberate decision of the
SNMPv3 WG.

In USM and SNMPv1 and SNMPv2c community-based security models, whether
auth and priv are asserted is based on a binary decision (an auth and
priv protocol have been specified or not), not the degree of trust in
the underlying security protocol. (RFC3413 3.1 2) and 3), and RFC3584
5.2.1)

In TSM, we accept the assertion made by the transport model. SSHTM
makes its assertion based on "we have specified that the operator MUST
configure for authpriv and to do otherwise is not compliant with this
specification." It is up to the operator to ensure it is compliant.

If an operator does not feel the underlying protocol really provides
adequate authpriv support, then they should configure it to not be
used with SNMP. I do not support TSM having a table to decide whether
"auth" is "auth enough" or "priv" is "priv enough".

dbh

> -----Original Message-----
> From: Wes Hardaker [mailto:wjhns1 at hardakers.net] 
> Sent: Friday, July 04, 2008 11:02 AM
> To: David Harrington
> Cc: 'David B. Nelson'; isms at ietf.org
> Subject: Re: [Isms] pre11 comments
> 
> >>>>> On Fri, 4 Jul 2008 10:58:45 +0800, "David Harrington" 
> <ietfdbh at comcast.net> said:
> 
> DH> I think the case Wes is concerned with happens 1% of the time,
and
> DH> with thoughtful configuration can be reduced to 0.00763% 
> of the time
> DH> (OK, I'll settle for 80/20).
> 
> Then why was the VACM designed to operate differently based on the
> security protocol?  Was that over-done and it should have 
> been a simple
> vc/v3 enum instead?
> 
> -- 
> Wes Hardaker
> Sparta, Inc.
> 

_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms