[Date Prev][Date Next]
Re: Open LDAP and SNMP
Michael Ströder wrote:
Mark H. Wood wrote:
damned, still did not have time to take care of this thing .....
Regarding security ..... Look, there are several simple things one
1) It is up to you to make your network secure. In general, as soon as
"start TLS" is considered as secure, SNMP set up in proper way may be
considered to be secure too. Look, considering SSL or "start TLS" as
secure mainly indicates that you forgot for a moment that OpenLDAP
expectes unencrypted private key on a file system. I wonder if you
managed to pass through any meaningful auditing .... Keeping this in
mind I would like to propose to omit further discussion on this subject.
2) It is up to you to use SNMP as a management tool or not. It is the
same as with monitor backend - you either have it or not. You decide to
have it or not via configure script.
3) As soon as you trust your employees the possibility to administrate
something over SNMP is definitly cool thing. It does not make your setup
more insecure as it is absolutely insecure already (see p.1), however
makes it more handy.
Best regards, vadim tarassov.
On Sat, 5 Apr 2003, [ISO-8859-1] Michael Ströder wrote:
Personally I'm rather scared of security aspects with SNMP. But I'm not
really up-to-date with recent SNMP standardization/implementations.
Security in SNMPv1 and v2 is a cruel joke. SNMPv3 has real
authentication and privacy. The greatest remaining problem in this area
is that many, many products still haven't implemented v3.
That's pretty much exactly like I suspected the situation to be.
I'd definitely prefer OpenLDAP to have admin capabilities via LDAP
instead of bloating the code with SNMP. LDAP access can be secured by
LDAPS, LDAPI, StartTLS ext.op. and could rely on the security model
already implemented and well-understood by the OpenLDAP developers.
Adding SNMP would introduce a new security model. People in favor of
SNMP support should implement their own admin gateways to an upcoming
LDAP-based administration interface.