Subject: Re: [Ips] IPS Authorization MIB

From: Keith McCloghrie <[email-masked]>
Date: Tue, 15 Feb 2005 09:18:40 -0800 (PST)

> >4) I suggest that relationship to other mib modules should at least
> >discuss how this table relates to the USM mib, which also contains a
> >list of users for authentication/authorization purposes for SNMP.
>
> I'm not quite sure what to do with this one.
> 
> The USM MIB is used to specify access to SNMP itself via SNMPv3 
> authentication etc,
> right?  The ips-auth MIB is used to specify users of IP storage devices, 
> which use an
> entirely different set of credentials and authentication protocols.  I 
> haven't seen a reference
> to the USM mib in other MIBs; what do you have in mind?  Other than the 
> fact that since
> security-related information is set and retrieved through the ips-auth 
> MIB, necessitating
> SNMPv3 and USM, is there anything else I need to be saying?
 
Perhaps the issue here is that draft-ietf-ips-auth-mib-06.txt
talks about "users" but it never explains that its underlying intent
is for "users of IP storage devices".  How about including an
introductory statement to say something like:

   The term "user" in this document is intended to include, but is not
   limited to, users of IP storage devices, but it excludes SNMPv3
   users (e.g., as defined in RFC 3414).
 
> >6) You suggest that a name should be globally unique. "globally" is
> >not sufficiently specific to be unambiguous. If you truly mean that
> >there is only one anywhere on earth, that's pretty hard to guarantee.
> >You probably mean within an adminstrative domain, but given multiple
> >protocols sharing the table, even that might be difficult to pin down.
> >You'll need to determine just what the requirement is to make this
> >unambiguous.
>
> In the iSCSI case (the first MIB to reference this one), an ipsAuthIdentName
> is equivalent to an iSCSI name, which is, if allocated according to RFCs 
> 3720-22, globally unique.  Of course, if another protocol is sharing
> the table, the requirement for this may be different.
> 
> Perhaps it would be better to state that this name must be unique within 
> whatever context (not in the SNMP sense) makes sense for the referencing 
> protocol.  That sounds a bit like a cop-out, but it might solve the problem.
 
I agree, and it will be useful to include the iSCSI example.  In fact,
perhaps this MIB should recommend that every other document which
proposes the use of this MIB for its "users", e.g., the iSCSI MIB,
needs to specify the how such a name is unique and over what domain.
(Note I suggest you use the word "domain" rather than "context".)

Keith.

_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips

---

From: Mark Bakke <[email-masked]>
Date: Tue, 15 Feb 2005 21:14:28 -0600

Keith,

I like both of your suggestions.

David, do these solutions resolve your #4 and #6?

Thanks,

Mark

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 17 Feb 2005 16:39:37 -0500

Hi,

I think it addresses issues #4 and #6, but not enough.

I think for #4, it needs to be a bit more explicit about what this is
meant to be used for, and why it should be limited to the intended
use. I would like to see unambiguos descriptions of why this is
suitable for its intended use, and not suitable for other uses.

If it is only meant to be used for storage protocols, what makes it
storage-specific?
Why would it not also be potentially useful for, say, SNMP security
models?
What attributes of its design make it unsuitable for other protocols
(such as SNMP security models)? 
If certain attributes (especially attributes related to security) make
it unsuitable for use by other protocols, why is it suitable for
storage protocols?

For #6, I suggest the document provide a clear explanation of the
threats that MUST be addressed by any other document that proposes to
use this mib module. I have concerns that any other protocol that uses
this could provide a lesser level of security, and thereby compromise
all the protocols that use it.

David Harrington
[email-masked]

> -----Original Message-----
> From: Mark Bakke [mailto:[email-masked]] 
> Sent: Tuesday, February 15, 2005 10:14 PM
> To: Keith McCloghrie
> Cc: [email-masked]; [email-masked]; 
> [email-masked]; Marjorie Krueger
> Subject: Re: [Ips] IPS Authorization MIB
> 
> Keith,
>