Re: Open LDAP and SNMP

[Michael Ströder <michael@stroeder.com>]

Mark H. Wood wrote:
> On Sat, 5 Apr 2003, [ISO-8859-1] Michael Ströder wrote:
> [snip]
>
> > Personally I'm rather scared of security aspects with SNMP. But I'm not
> > really up-to-date with recent SNMP standardization/implementations.
>
> Security in SNMPv1 and v2 is a cruel joke.  SNMPv3 has real cryptographic
> authentication and privacy.  The greatest remaining problem in this area
> is that many, many products still haven't implemented v3.

That's pretty much exactly like I suspected the situation to be.

I'd definitely prefer OpenLDAP to have admin capabilities via LDAP instead 
of bloating the code with SNMP. LDAP access can be secured by LDAPS, LDAPI, 
StartTLS ext.op. and could rely on the security model already implemented 
and well-understood by the OpenLDAP developers.

Adding SNMP would introduce a new security model. People in favor of SNMP 
support should implement their own admin gateways to an upcoming LDAP-based 
administration interface.

Ciao, Michael.