Re: [Isms] SNMP "access control" terminology

Hi -

> From: "Juergen Schoenwaelder" <j.schoenwaelder@iu-bremen.de>
> To: "Randy Presuhn" <randy_presuhn@mindspring.com>
> Cc: <isms@ietf.org>
> Sent: Sunday, July 02, 2006 11:18 PM
> Subject: Re: [Isms] SNMP "access control" terminology
...
> a) authentication backend for password/keyboard-interactive
>    (transparent for ISMS as far as I can tell, easy)
> 
> b) authorization (once authenticated)
>    (easy when you use RADIUS for authentication, difficult when you
>    use public keys or kerberos since in this case authorization is
>    different from authentication and RADIUS does not seem to like
>    it (and I still have to understand what the difference between
>    RADIUS and DIAMETER is in this aspect since the later seems to
>    like it better))

Does the distinction between (a) and (b) matter?  It's a question
of what attacks would be possible by the set of users who could
be authenticated but not "authorized" who would somehow be able
to cause mischief despite being prevented from "doing" anything by
the access control model.  I think this boils down to DoS attacks,
and would perhaps be more interesting than in a USM world if
sessions consumed substantial resources.

> c) mapping of security names to group names (roles)
>    (requires to call radius within VACM or cached information must be
>    passed to VACM from somewhere, requires to work out how such
>    dynamic information coexists with provisioned VACM security to
>    group mappings)
> 
> I think this is what <draft-narayan-isms-sshsm-radius-00.txt>
> discusses.
...

Randy

_______________________________________________
Isms mailing list
Isms@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms