Re: [secdir] Review of draft-ietf-isms-radius-usage-05

["Dave Nelson" <[e-mail]>]

Sam Hartman writes...

> I'm sorry, but I didn't understand this answer at all.

Yeah, I'm afraid I've muddled up what this document is about with what
*might* happen outside the scope of the document, in an attempt to answer
Eric's questions.

> It seems like you're both saying "you can't do that with RADIUS 
> (what I thought the answer was)," and "the ssh server."  I don't 
> understand how to reconcile those.

Let me try again.  What's being standardized is the use of RADIUS to
outsource user authentication and service authorization for SNMP access.
This works with SNMP Transport Models, e.g. with SSHTM.  Only those
authentication methods that are natively supported in RADIUS, e.g. password,
are in scope for this document.

In the case of SSH, there are other authentication methods, such as public
key.  Such methods cannot be use with RADIUS as described in this document.
Full stop.

I added some confusion when I attempted to indicate that SSH and SSHTM
*might* be used with SSH public key authentication, but *not* with RADIUS.
In that case the use authentication resides with the local SSH server
implementation in the NAS.  Presumably the public key(s) of the user(s)
has/have been installed in the SSH server's local configuration data store.
This has nothing to do with RADIUS.  It has no central AAA component, and
credentials are provisioned on a device-by-device basis.  This is what many
deployments of SSH with public key have today.  It can be used with SNMP,
after a fashion.  However, it has nothing to do with the document under
review.  Sorry to have introduced that confusion.