1. RADIUS Attributes for Management Authorization David B. Nelson IETF 66, RADEXT WG July 10, 2006

2. Need for Management Attributes RADUIS currently defines two attributes for management Both are for “CLI” style interface –Service-Type = Administrative –Service-Type = NAS-Prompt No attributes for provisioning other forms of management interfaces

3. Need for Management Attributes Need for attributes that describe non-CLI management interfaces –SNMP –HTTP –SFTP –SCP Potential consideration for NETCONF?

4. Need for Management Attributes Need for attributes to specify secure vs. non-secure management interfaces –SSH –SNMP v3 –HTTPS / TLS

5. Need for Management Attributes Need for attributes to specify roles or privilege levels –SNMPv3 VACM entries Like the Filter-ID attribute, but for management –Split horizon views Layer 2 management view Layer 3 management view Etc.

6. Need for Management Attributes Need attributes to authorize management commands on a per-command or per- operation granularity Need attributes to provide an audit trail, on a per-command basis, via accounting for configuration changes to facilitate problem resolution Provides feature-parity with TACACS+

7. Possible solution approach Internet-Draft: draft-nelson-radius- management-authorization-03.txt Service-Type = Framed-Management Management-Access-ID –A named access policy, similar to Filter-ID –Name is of local scope –Could be a privilege level –Could be a group name that maps to a VACM table entry

8. Possible solution approach Management-Protocol –Used in conjunction with a Service-Type of Framed-Management –Values might be: SNMP-V3 (SSHSM) HTTP HTTPS-TLS

9. Possible solution approach Non-Framed-Management-Command A command line interface (CLI) interaction Framed-Management-Operation A SNMP/HTTP operation Management-Context Contextual information for above two. For example, a CLI sub-mode, menu name, virtual router instance, administrative role

10. Changes since -01 Added a section on the use of “Authorize Only” Diameter Translation section revised. Security Consideration section revised. References section revised.

11. Is there an interest? Meets some of the requirements for authorization of SNMPv3 in the ISMS WG If the management access services that these attributes specify are of multi-vendor applicability, it would be better to define them as standard attributes Is there interest in working on defining such attributes, and creating implementations? Ready for adoption as a WG work item?