[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Open LDAP and SNMP

Mark H. Wood wrote:
On Sat, 5 Apr 2003, [ISO-8859-1] Michael Ströder wrote:

Personally I'm rather scared of security aspects with SNMP. But I'm not
really up-to-date with recent SNMP standardization/implementations.

Security in SNMPv1 and v2 is a cruel joke. SNMPv3 has real cryptographic authentication and privacy. The greatest remaining problem in this area is that many, many products still haven't implemented v3.

That's pretty much exactly like I suspected the situation to be.

I'd definitely prefer OpenLDAP to have admin capabilities via LDAP instead of bloating the code with SNMP. LDAP access can be secured by LDAPS, LDAPI, StartTLS ext.op. and could rely on the security model already implemented and well-understood by the OpenLDAP developers.

Adding SNMP would introduce a new security model. People in favor of SNMP support should implement their own admin gateways to an upcoming LDAP-based administration interface.

Ciao, Michael.