RE: [Isms] SSHSM RADIUS Integration draft(draft-narayan-isms-sshsm-radius-01.txt) submitted

Hi,

Following ietf66, we changed direction somewhat in ISMS. There is no
SSHSM anymore; there is a Transport subsystem, an SSH-TM (transport
model), and a TSM (Transport Security Model).

Currently, we do not pass the tmStateReference into the
IsAccessAllowed ASI. I don't think we even pass it tothe applications,
and the applications call IsAccessAllowed, so you may be talking about
changing a few ASIs.

Another way to approach the problem would be to use a MIB to store the
transport&security information in a local configuration database
addressable by securityName/securityModel/securityLevel and
transportDomain/Address. Another RADIUS-specific MIB could contain
RADIUS information, and that MIB could AUGMENT the transport&security
MIB.

Actually I can envision 3 MIB modules:
1) known to a specific transport model, indexed by
securityN/L,transportD/A, independent of securityModel
2) known to the Transport Security Model, contains TSM-specific info
indexed by securityN/L and trasnportD/A, indepednent of specific
transport models but it can get a pointer to a specific transport row
using securityNL,transportDA
3) a RADIUS-specific MIB indexed by securityM/N/L,transportDA. This
MIB could store authoriaztion info and the RADIUS state. A
RADIUS-spepxcifc ACM could check for a RADIUS state attribute in the
transport model MIB.

I'm not sure this maintains the modulairty as much as we want, but at
least we' can try to lay the MIBs out in a way that they can remain
independnent of each other, and define some common MOs to be used by
potentially multiple models within a subsystem, and make the MOs
accessible in a model-independent manner from other subsystems.

dbh

  _____  

From: Kaushik Narayan (kaushik) [mailto:kaushik@cisco.com] 
Sent: Wednesday, March 14, 2007 3:20 PM
To: isms@ietf.org
Subject: [Isms] SSHSM RADIUS Integration
draft(draft-narayan-isms-sshsm-radius-01.txt) submitted 

Hi All,

The RADIUS integration draft for SSHSM has been submitted to the
drafts directory. The draft specifies details how RADIUS could be used
as an authentication and authorization mechanism for SSHSM. 

This draft currently describes two approaches for integration of
authorization information returned from the RADIUS server.

a. Receive authorization information along with authentication request
(traditional RADIUS model) & cache authorization information within
TMSM. Augment VACM in an implementation-dependent fashion to fetch
authorization parameters from TMSM (using tmStateReference).
b. Define a new access control model that can issue direct RADIUS
authorize-only requests to fetch authorization information on demand.
This approach will also require the use of the TMSM cache to store the
RADIUS state attribute. The draft does not elaborate on the details of
such an access control model.

We need further discussion within the WG on the two approaches and
whether we need to elaborate on both. 

regards,
 David Nelson & Kaushik Narayan