1. RADIUS Extended Attributes for Management Authorization David B. Nelson IETF 62, RADEXT WG March 9, 2005

2. Need for Management Attributes RADUIS currently defines two attributes for management Both are for “CLI” style interface –Service-Type = Admin –Service-Type = NAS-Prompt No attributes for provisioning other forms of management interfaces

3. Need for Management Attributes Need for attributes that describe non-CLI management interfaces –SNMP –HTTP

4. Need for Management Attributes Need for attributes to specify secure vs. non-secure management interfaces –SSH –SNMP v3 –HTTPS / TLS

5. Need for Management Attributes Need for attributes to specify roles or privilege levels –SNMPv3 VACM entries Like the Filter-ID attribute, but for management –Split horizon views Layer 2 management view Layer 3 management view Etc.

6. Need for Management Attributes Need attributes to authorize management commands on a per-command or per- operation granularity Need attributes to provide an audit trail, on a per-command basis, via accounting for configuration changes to facilitate problem resolution Provides feature-parity with TACACS+

7. Possible solution approach Internet-Draft: draft-nelson-radius- management-authorization-01.txt Service-Type = Framed-Management Management-Access-ID –A named access policy, similar to Filter-ID –Name is of local scope –Could be a privilege level –Could be a VACM table entry

8. Possible solution approach Management-Protocol –Used in conjunction with a Service-Type of Framed-Management –Values might be: SNMP-V3 HTTP HTTPS-TLS

9. Possible solution approach Non-Framed-Management-Command A command line interface (CLI) interaction Framed-Management-Operation A SNMP/HTTP operation Management-Context Contextual information for above two. For example, a CLI sub-mode, menu name, virtual router instance, administrative role

10. Changes since -00 For use in ISP, roaming consortia, public access, and similar environments, “split-horizon” AAA should be used for management access. Text added in Proxy Operations section. SNMPv1 and SNMPv2c values of Framed- Management-Protocol removed. Attributes related to granular authorization/accounting of CLI commands added.

11. Is there an interest? Enterasys Networks is working in this area using Vendor-Specific attributes If the management access services that these attributes specify are of multi-vendor applicability, it would be better to define them as standard attributes Is there interest in working on defining such attributes, and creating implementations?

12. Questions? Feedback?