Re: [Isms] SSHSMRADIUSIntegrationdraft(draft-narayan-isms-sshsm-radius-01.txt)submitted

Juergen Schoenwaelder wrote:
> Anyway, I am in general quite confused by this thread as it seems that
> people talk about different things without really trying to understand
> the other's background / terminology / view of the world.
>
> Perhaps it helps to go through the RADIUS document and to bring up
> paragraphs that are considered problematic and to propose alternative
> text fragments so that we avoid getting trapped in some general and
> abstract discussions that we had in the past and which might not be
> effective to improve our documents.
>   

TMSM should work both with a local store AND radius.  If there are 
problems with either that's what needs to be found.  This thread came up 
because David Nelson wrote:
> The modularity of the current SNMP architecture seems to be predicated upon
> the notion that passing around securityName is all that is ever needed.
> That seems to be predicated on the notion that there is a local
> configuration store that contains useful information addressed by
> securityName.  That seems to imply USM or something very much like it.  If
> we really want to break the ties to USM, we're going to need to address this
> issue.
>   

And then Dave Harrington responded:

> So far, I have not seen any proposals, either written or just proposed
> verbally, that provides a secure transport with all the security
> characteristics of USM. A critical feature of USM, not provided by SSH
> or TLS or RADIUS proposals so far, is local authentication with NO
> ties to a third party authenticator.
>   

Kaushik, Keith and I proposed a method last summer that would have 
precisely addressed the 2nd sentence in that paragraph.  I believe this 
leaves David Nelson's question somewhat unanswered.

Eliot

_______________________________________________
Isms mailing list
Isms@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms