RE: [Isms]SSHSMRADIUSIntegrationdraft(draft-narayan-isms-sshsm-radius-01.txt)submitted

Hi,

Yes, I was off-track.
A local password or key pair should be acceptable.

dbh 

> -----Original Message-----
> From: Juergen Schoenwaelder [mailto:j.schoenwaelder@iu-bremen.de] 
> Sent: Friday, March 16, 2007 7:41 AM
> To: Eliot Lear
> Cc: Kaushik Narayan (kaushik); David Harrington; David B. 
> Nelson; isms@ietf.org
> Subject: Re: 
> [Isms]SSHSMRADIUSIntegrationdraft(draft-narayan-isms-sshsm-rad
> ius-01.txt)submitted
> 
> On Fri, Mar 16, 2007 at 12:26:08PM +0100, Eliot Lear wrote:
>  
> > And then Dave Harrington responded:
> > 
> > >So far, I have not seen any proposals, either written or 
> just proposed
> > >verbally, that provides a secure transport with all the security
> > >characteristics of USM. A critical feature of USM, not 
> provided by SSH
> > >or TLS or RADIUS proposals so far, is local authentication with
NO
> > >ties to a third party authenticator.
> > 
> > Kaushik, Keith and I proposed a method last summer that would have

> > precisely addressed the 2nd sentence in that paragraph.  I 
> believe this 
> > leaves David Nelson's question somewhat unanswered.
> 
> Again, is a local password or key pair in the context of SSH not
> exactly addressing the 2nd sentence above, namely "local
> authentication with NO ties to a third party authenticator"? I
remain
> in the confused state for now.
> 
> /js
> 
> PS: Our implementation calls out to PAM and it actually does not
>     matter whether you configure radius, something else, or local
>     passwords if you like that.
> 
> -- 
> Juergen Schoenwaelder		 Jacobs University Bremen
> <http://www.eecs.iu-bremen.de/>	 P.O. Box 750 561, 
> 28725 Bremen, Germany
> 

_______________________________________________
Isms mailing list
Isms@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms