Re: [Isms]SSHSMRADIUSIntegrationdraft(draft-narayan-isms-sshsm-radius-01.txt)submitted

On Fri, Mar 16, 2007 at 11:53:44AM -0700, Kaushik Narayan (kaushik) wrote:
> Hi Juergen,
> 
> I think the question atleast in my mind is about not whether we would
> support local accounts but more about how to handle them in the context
> of the current RADIUS integration draft. As I suggested in my previous
> thread we have two options
> 
> 1. Leave to implementation specific approaches such as a Pluggable
> Authentication Module (PAM) framework.

As an implementor and system administrator, I like PAM because this is
used by many pieces of software...

> 2. Build the chaining of authentication methods into the security model,
> this would be required especially if we want build an access control
> model that is RADIUS specific.
> 
> It would be useful to get some discussion on this topic.

... and here I have no clue what this is supposed to be good for or
why things are needed in the security model; remember that access
control is done in the access control model (and all the security
processing including authentication exchanges happen in the secure
transport models, at least for SSH or TLS. Are you saying all the
work in the last months was heading in the wrong direction??

My understanding is that we have in principle two mappings:

a) authenticated principal -> securityName
b) securityName -> groupName

The first mapping a) happens in the security model (USM) or in the
transport mappings (TSM). The mapping b) happens in the access control
subsystem, that is VACM. We should not confuse these things (I think
section 3.3.2 in the RADIUS document is pretty unclear and potentially
confusing things, e.g. sentences such as

   The User-
   Based Security Method (USM) integrates with VACM, by mapping the user
   identity as defined in USM to access rights within VACM.

seem wrong since all USM provides is a securityName. Do you say this
is all wrong? Or is it about how to pass RADIUS attributes provided in
a) up to an access control mapping which does b) that you have in
mind?

/js

-- 
Juergen Schoenwaelder		 Jacobs University Bremen
<http://www.eecs.iu-bremen.de/>	 P.O. Box 750 561, 28725 Bremen, Germany

_______________________________________________
Isms mailing list
Isms@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms