Let's not prune back to V1 security. Was: Re: Configuring...

["Karl Auerbach, Empirical Tools and Technologies, 408/427-5280" <[e-mail]>]

 > > The original message on this thread was a about configuring community
 > > strings, a V1 concept.  Hence my principle text was how one might do
 > > some V2 things in V1.

 > I would like to explore the inverse of this idea; that is, how to make
 > V1-like things under V2. The general idea is to define a subset of 
 > the V2 security/authentication mechanism which is the functional 
 > equivalent of V1 as to both (1) requirements on the underlying 
 > agent and (2) community-based security.

I suspect that there are others out there who have the same goal.

But I would not want to support an effort to create a subset that had
as little security as V1.  We *really* need that improved security to
get people to really use set-request (at which point I expect we'll
see a whole new set of snmp "interesting situations" arise.)

The benefits gained by the V2 authentication functions are worth the
cost, in my opinion.

(I don't want to express an opinion on the privacy parts of V2 other
than what I have said in prior notes.)

 > IMHO, it seems to me that it is worth while at least to check how 
 > feasible it is. So, do not beat up on me too much if it is wrongheaded.

I'd better not comment much on that.  Please recognize that nobody out
there is a horrible, malignant presence.  Rather, everybody on these
lists is really working towards network management nirvina, but some
of us have less graceful ways of writing than others, with myself
being one of the extreme examples of being able to use exactly the
wrong words at the wrong time.

BTW -- I haven't had time to read the technical content of your note
yet.

		--karl--