Subject: [Ietf-krb-wg] kerberos security model for snmp

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 26 Oct 2010 10:10:56 +0200

Hi,

a kerberos security model for the simple network management protocol
(snmp) has been proposed to the ISMS working group. I like to solicit
feedback on the proposal from the kerberos community. The document can
be found here:

http://tools.ietf.org/html/draft-pejaver-isms-kerberos-01

We are going to have a technical discussion of this proposal at the
Beijing IETF in the Wednesday 15:10-16:10 time slot. Perhaps some of
you can join this meeting to make sure things are heading into the
right direction. Please send any questions / comments to the ISMS
working group mailing list <[email-masked]>.

/js (ISMS co-chair)

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Tue, 26 Oct 2010 11:49:22 -0400

>>>>> "Juergen" == Juergen Schoenwaelder <[email-masked]> writes:

    Juergen> Hi, a kerberos security model for the simple network
    Juergen> management protocol (snmp) has been proposed to the ISMS
    Juergen> working group. I like to solicit feedback on the proposal
    Juergen> from the kerberos community. The document can be found
    Juergen> here:

My main question here would be why you'd do this rather than just using
the ssh security model.  I can think of some reasons you might have, but
I'd want to carefully understand that before going down a path of having
multiple mechanisms to do the same thing.

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 26 Oct 2010 18:31:14 +0200

> multiple mechanisms to do the same thing.

Sam,

my understanding is that this proposal is targeting cable networks
where they are looking for a security solution that is lightweight
(avoiding session state) so that they can poll a huge number of
devices located in customer premises efficiently. The ID discusses
some of this in section 2.2 I think. Anyway, I as WG co-chair, I am
just trying to make the Kerberos community aware of this; if people
have concrete questions, please post them to the ISMS WG mailing list
and/or join the ISMS WG meeting in Beijing.

/js