Re: [Isms] ISMS charter broken- onus should be on WG to fix it

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On Tuesday, September 13, 2005 05:23:26 PM -0700 Ned Freed <ned.freed@xxxxxxxxxxx> wrote:

> I suspect that the ssh community would decline to extend ssh in this
> direction; I certainly know I would not support it.

I'm not entirely sure _how_ I'd extend SSH in this direction, or how much
utility it would have.  I don't think I would object to it, especially
since I suspect it might make some of the ISMS cases easier even if you
don't care about the firewall problem.

Well, the ssh client I use has the ability to do port forwarding in both
directions already. The only thing that has stopped me from using this
feature
to do SNMP monitoring of various mobile agents is that it doesn't work
with
UDP, and the SNMP stuff I use is UDP only.

Aha! Another use case for UDP tunnelling in SSH, which is a topic that was recently brought up in that WG.

In any event, the problem isn't carrying the SNMP traffic over an ssh connedction -- we're fairly confident we know how to do that, though the document isn't done yet. The problems are in determining when to establish an SSH connection for the purpose of _receiving_ traffic, and in making authentication work in cases where a managed device wants to authenticate to something that is essentially a user. With some authentication infrastructures the latter is easy; with others it is not. The former I think is always hard, but has nothing to do with SSH per se.

I think that we can easily avoid making call-home harder than it needs to be, and that we should. I would not object to a change in ISMS's charter requiring that it consider the potential effects of any security solution it adopts on the ability to add a call-home mechanism, but I also don't think such a provision is necessary to achieve the desired result.

I don't think extending the SNMP architecture to add call-home is within the scope of ISMS's charter, and I don't think it would be appropriate to add it at this time. I'm not quite as concerned as Margaret is about the "wrong area" problem, provided the right people are active in the WG and reviewing its output, which I believe is necessary in any event.

However, I do believe the problems are separable, nearly orthogonal, and require somewhat different expertise. Provided that the ISMS work does not preclude call-home or some other solution to the problem, I think a narrowly-scoped working group is appropriate here.

-- Jeff

_______________________________________________

Ietf@xxxxxxxx
https://www1.ietf.org/mailman/listinfo/ietf

[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Fedora Users]