Re: [MIB-DOCTORS] Readable and MAXACCESS

Hi,
 > Yes.  The sensitivity of indexes needs to be considered in
 > the formulation of an access control policy.
Thanks. Agreement on that. But I think that there is an
additional issue.
Even with appropriate access control policy, if
appropriate encryption is not used index objects may
reveal/leak information (to an eavesdropper) . e.g. in
the tcpConnTable the index objects
               tcpConnLocalAddress,
               tcpConnLocalPort,
               tcpConnRemAddress,
               tcpConnRemPort
reveal the existence of a connection/conversation.
Or, in the usmUserTable the index usmUserName reveals the
userName. (Note that userName has MAX-ACCESS not-accessible.)

So, does the following sentence in the The Security Guidelines
for IETF MIB modules needs rewording?

 >>     Some of the readable objects in this MIB module (i.e., objects
 >>     with a MAX-ACCESS other than not-accessible) may be considered
 >>     sensitive or vulnerable in some network environments.

Would the following be appropriate ?
      Some of the readable objects in this MIB module (i.e., objects
      with a MAX-ACCESS other than not-accessible and objects that are
      visible as indices) may be considered
      sensitive or vulnerable in some network environments.
Glenn

On 2018/09/15 6:19, Randy Presuhn wrote:
> Hi -
> 
> On 9/14/2018 4:10 AM, Glenn Mansfield Keeni wrote:
>> Hi,
>>    The Security Guidelines for IETF MIB modules says
>>     Some of the readable objects in this MIB module (i.e., objects
>>     with a MAX-ACCESS other than not-accessible) may be considered
>>     sensitive or vulnerable in some network environments.
>>
>> This seems to imply that objects that have MAX-ACCESS not-accessible
>> are not "readable". But the objects can very well be "read" from the
>> index, if the MO is an index object.
>> Then "not-accessible" objects too may be sensitive or vulnerable ?
> 
> Yes.  The sensitivity of indexes needs to be considered in
> the formulation of an access control policy.
> 
> Randy
> 
> _______________________________________________
> MIB-DOCTORS mailing list
> MIB-DOCTORS@ietf.org
> https://www.ietf.org/mailman/listinfo/mib-doctors
> 