Re: [secdir] Secdir review of draft-ietf-opsawg-vmm-mib-02

["Christian Huitema" <[e-mail]>]

Yes, your security section does mention the need to control GET as well.

> -----Original Message-----
> From: Juergen Schoenwaelder [mailto:[e-mail]]
> Sent: Friday, May 22, 2015 11:14 PM
> To: Christian Huitema
> Cc: 'The IESG'; [e-mail];
[e-mail]
> Subject: Re: Secdir review of draft-ietf-opsawg-vmm-mib-02
> 
> Christian,
> 
> thanks for the review. I am not sure if anything needs changes. The
> draft largely follows the security considerations template for MIB
> modules. And there is explicit text about GET access:
> 
>    [...]  Moreover, the objects in the vmTable,
>    vmCpuTable, vmCpuAffinityTable, vmStorageTable and vmNetworkTable
>    list information about the virtual machines and their virtual
>    resource allocation.  Some may wish not to disclose to others how
>    many and what virtual machines they are operating.
> 
>    It is thus important to control even GET access to these objects and
>    possibly to even encrypt the values of these object when sending them
>    over the network via SNMP.  Not all versions of SNMP provide features
>    for such a secure environment.
> 
> Is this text not already covering your concerns? Below the quoted
> text, there is the general boilerplate recommendation to avoid SNMPv1
> and to use SNMPv3 instead.

The "GET" paragraph feels a bit generic. I would personally be a bit
stronger. Something like, "It is NOT RECOMMENDED" to provide access to these
variables without using the strong security features of SNMPv3. Of course,
this is a generic problem with SNMP, and I understand your desire to use the
generic text. But is there a good reason to not recommend v3?

I would also mention the specific problem of software running in a virtual
machine and accessing the hypervisor's variables. This is an attack vector
that is somewhat specific to this MIB. It cannot be mitigated by network
firewalls.

-- Christian Huitema