<inline>
Tom Petch
----- Original Message -----
From: "Faye Ly" <fayely@juniper.net>
To: "Andy Bierman" <ietf@andybierman.com>; "Sharon Chisholm"
<schishol@nortel.com>
Cc: <netconf@ops.ietf.org>
Sent: Wednesday, July 06, 2005 8:14 PM
Subject: RE: Proposed Update to Netconf Charter
Andy,
I agree with 'defining common authentication scheme for access control'
and also would like to see 'define a way to multiplex channels over a
single secured connection between manager and agent'. The latter is
needed to support multiple management channels like notification,
syslog, image/file management and/or regular netconf.
This is to help lower the cost of configuring many secured connections
between manager and agent.
-faye
Common authentication implies that you are authenticating the same thing. SNMP,
because the operators wanted it, authenticates a 'principal' which may or may
not correspond to a human user, but is distinct from the platform which is
providing the other end of the connection. I think it easy, and at times too
simplistic, to think in terms of setting up a secure channel with, and
authenticating, a 'client' (or server) without realising that one should be
authenticating at a finer level of detail. The 'principals' for syslog, netconf
etc may be different even though they share a secure channel and platform.