Re: [secdir] Secdir review of draft-ietf-opsawg-vmm-mib-02

[Juergen Schoenwaelder <[e-mail]>]

Christian,

thanks for the review. I am not sure if anything needs changes. The
draft largely follows the security considerations template for MIB
modules. And there is explicit text about GET access:

   [...]  Moreover, the objects in the vmTable,
   vmCpuTable, vmCpuAffinityTable, vmStorageTable and vmNetworkTable
   list information about the virtual machines and their virtual
   resource allocation.  Some may wish not to disclose to others how
   many and what virtual machines they are operating.

   It is thus important to control even GET access to these objects and
   possibly to even encrypt the values of these object when sending them
   over the network via SNMP.  Not all versions of SNMP provide features
   for such a secure environment.

Is this text not already covering your concerns? Below the quoted
text, there is the general boilerplate recommendation to avoid SNMPv1
and to use SNMPv3 instead.

/js

On Wed, May 13, 2015 at 07:49:05PM -0700, Christian Huitema wrote:
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the security area
> directors.  Document editors and WG chairs should treat these comments just
> like any other last call comments.
> 
> For the security area directions, I consider this document to be "Ready with
> nits".
> 
> This document specifies objects (MIB) for managing virtual machines
> controlled by a hypervisor (a.k.a. virtual machine monitor) using SNMP.
> 
> The security section is thoroughly written, points out the operational risk
> if some management variables can be SET, and the privacy or other security
> risks if hostile parties can read some of the objects. The essential
> recommendation is to use SNMPv3 strong security, or when that strong
> security is not available, to disable the "SET" capabilities. 
> 
> There is an aggravating factor not mentioned in the security section. In
> many large data centers, some virtual machines will not be under the direct
> control of the data center manager. They may have been rented to third
> parties, or they may have been subverted. These potentially hostile virtual
> machines will have direct network connectivity with the hypervisor, and
> potentially with other hypervisors in the same subnet. Attackers in control
> of these machines can gain advantage of even read-only access to hypervisor
> state variables. One wonders whether even GET access should be allowed in
> the absence of authentication through SNMPv3. Attempting to support even GET
> operations with prior versions of SNMP appears risky.
> 
> -- Christian Huitema
> 
> 
> 
> 

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <http://www.jacobs-university.de/>