--- 1/draft-ietf-radext-rfc2619bis-00.txt 2006-02-04 17:26:02.000000000 +0100 +++ 2/draft-ietf-radext-rfc2619bis-01.txt 2006-02-04 17:26:02.000000000 +0100 @@ -1,18 +1,18 @@ Network Working Group D. Nelson Internet-Draft Enterasys Networks -Updates: RFC 2619 (if approved) August 30, 2005 -Expires: March 3, 2006 +Obsoletes: RFC 2619 (if approved) October 18, 2005 +Expires: April 21, 2006 RADIUS Auth Server MIB (IPv6) - draft-ietf-radext-rfc2619bis-00.txt + draft-ietf-radext-rfc2619bis-01.txt Status of this Memo By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that @@ -23,46 +23,47 @@ and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. - This Internet-Draft will expire on March 3, 2006. + This Internet-Draft will expire on April 21, 2006. Copyright Notice Copyright (C) The Internet Society (2005). Abstract - This memo updates RFC 2619 by deprecating the MIB table containing + This memo obsoletes RFC 2619 by deprecating the MIB table containing IPv4-only address formats and defining a new table to add support for - version neutral IP address formats. + version neutral IP address formats. The remaining MIB objects from + RFC 2619 are carried forward into this document. Table of Contents 1. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. The Internet-Standard Management Framework . . . . . . . . . . 3 4. Scope of Changes . . . . . . . . . . . . . . . . . . . . . . . 3 5. Structure of the MIB Module . . . . . . . . . . . . . . . . . 4 6. Deprecated Objects . . . . . . . . . . . . . . . . . . . . . . 4 - 7. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 4 + 7. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 5 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 19 9. Security Considerations . . . . . . . . . . . . . . . . . . . 19 10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 20 10.1. Normative References . . . . . . . . . . . . . . . . . . 20 - 10.2. Informative References . . . . . . . . . . . . . . . . . 21 + 10.2. Informative References . . . . . . . . . . . . . . . . . 20 Appendix A. Acknowledgments . . . . . . . . . . . . . . . . . . . 21 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 22 Intellectual Property and Copyright Statements . . . . . . . . . . 23 1. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. @@ -86,51 +87,65 @@ the Management Information Base or MIB. MIB objects are generally accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms defined in the Structure of Management Information (SMI). This memo specifies a MIB module that is compliant to the SMIv2, which is described in STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580 [RFC2580]. 4. Scope of Changes - This document updates RFC 2619 [RFC2619], RADIUS Authentication + This document obsoletes RFC 2619 [RFC2619], RADIUS Authentication Server MIB, by deprecating the radiusAuthClientTable table and adding a new table, radiusAuthClientExtTable, containing radiusAuthClientInetAddressType and radiusAuthClientInetAddress. The purpose of these added MIB objects is to support version neutral IP addressing formats. The existing table containing - radiusAuthClientAddress is deprecated. + radiusAuthClientAddress is deprecated. The remaining MIB objects + from RFC 2619 are carried forward into this document. RFC 4001 [RFC4001], which defines the SMI Textual Conventions for version neutral IP addresses, contains the following recommendation. 'In particular, when revising a MIB module that contains IPv4 specific tables, it is suggested to define new tables using the textual conventions defined in this memo [RFC 4001] that support all versions of IP. The status of the new tables SHOULD be "current", whereas the status of the old IP version specific tables SHOULD be changed to "deprecated". The other approach, of having multiple similar tables for different IP versions, is strongly discouraged.' 5. Structure of the MIB Module - The structure of the MIB Module defined in this memo corresponds to - the structure of the MIB Module defined in RADIUS Authentication - Server MIB, RFC 2619 [RFC2619]. This MIB module contains fourteen - scalars as well as a single table, the RADIUS Authentication Client - Table, which contains one row for each RADIUS authentication client - with which the server shares a secret. + The RADIUS authentication protocol, described in RFC 2865 [RFC2865], + distinguishes between the client function and the server function. + In RADIUS authentication, clients send Access-Requests, and servers + reply with Access-Accepts, Access-Rejects, and Access-Challenges. + Typically NAS devices implement the client function, and thus would + be expected to implement the RADIUS authentication client MIB, while + RADIUS authentication servers implement the server function, and thus + would be expected to implement the RADIUS authentication server MIB. - Each entry in the RADIUS Authentication Client Table includes - thirteen columns presenting a view of the activity of the RADIUS - authentication server. + However, it is possible for a RADIUS authentication entity to perform + both client and server functions. For example, a RADIUS proxy may + act as a server to one or more RADIUS authentication clients, while + simultaneously acting as an authentication client to one or more + authentication servers. In such situations, it is expected that + RADIUS entities combining client and server functionality will + support both the client and server MIBs. + + This MIB module contains fourteen scalars as well as a single table, + the RADIUS Authentication Client Table, which contains one row for + each RADIUS authentication client with which the server shares a + secret. Each entry in the RADIUS Authentication Client Table + includes thirteen columns presenting a view of the activity of the + RADIUS authentication server. 6. Deprecated Objects The deprecated table in this MIB is carried forward from RFC 2619 [RFC2619]. There are two conditions under which it MAY be desirable for managed entities to continue to support the deprecated table: 1. The managed entity only supports IPv4 address formats. 2. The managed entity supports both IPv4 and IPv6 address formats, and the deprecated table is supported for backwards compatibility @@ -153,73 +169,62 @@ IMPORTS MODULE-IDENTITY, OBJECT-TYPE, OBJECT-IDENTITY, Counter32, Integer32, IpAddress, TimeTicks, mib-2 FROM SNMPv2-SMI SnmpAdminString FROM SNMP-FRAMEWORK-MIB InetAddressType, InetAddress FROM INET-ADDRESS-MIB MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF; radiusAuthServMIB MODULE-IDENTITY - LAST-UPDATED "20050830000Z" -- 30 Aug 2005 + LAST-UPDATED "200510170000Z" -- 17 Oct 2005 ORGANIZATION "IETF RADIUS Extensions Working Group." CONTACT-INFO " Bernard Aboba Microsoft One Microsoft Way Redmond, WA 98052 US Phone: +1 425 936 6605 EMail: bernarda@microsoft.com" DESCRIPTION "The MIB module for entities implementing the server side of the Remote Authentication Dial-In User Service (RADIUS) authentication protocol." + REVISION "200510170000Z" -- 17 Oct 2005 + DESCRIPTION "Revised version as published in RFC xxxx. + This version obsoletes that of RFC 2619 by deprecating the + MIB table containing IPv4-only address formats and defining + a new table to add support for version neutral IP address + formats. The remaining MIB objects from RFC 2619 are carried + forward into this version." REVISION "9906110000Z" -- 11 Jun 1999 DESCRIPTION "Initial version as published in RFC 2619" - REVISION "200508300000Z" -- 30 Aug 2005 - DESCRIPTION "Revised version as published in RFC xxxx." - -- RFC Editor: replace xxxx with actual RFC number at the time of -- publication, and remove this note. ::= { radiusAuthentication 1 } radiusMIB OBJECT-IDENTITY STATUS current DESCRIPTION "The OID assigned to RADIUS MIB work by the IANA." ::= { mib-2 67 } - radiusAuthServerExtMIB OBJECT-IDENTITY - STATUS current - DESCRIPTION - "The OID assigned to RADIUS Extensions MIB - work by the IANA." - ::= { mib-2 TBA } - -- RFC Editor: replace TBA with IANA assigned OID value, and - -- remove this note. - radiusAuthentication OBJECT IDENTIFIER ::= {radiusMIB 1} radiusAuthServMIBObjects OBJECT IDENTIFIER ::= { radiusAuthServMIB 1 } radiusAuthServ OBJECT IDENTIFIER ::= { radiusAuthServMIBObjects 1 } - radiusAuthServerExtMIBNotifications OBJECT IDENTIFIER - ::= { radiusAuthServerExtMIB 0 } - - radiusAuthServerExtMIBObjects OBJECT IDENTIFIER - ::= { radiusAuthServerExtMIB 1 } - radiusAuthServIdent OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "The implementation identification string for the RADIUS authentication server software in use on the system, for example; `FNS-2.1'" ::= {radiusAuthServ 1} @@ -514,31 +519,31 @@ radiusAuthServUnknownTypes OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS deprecated DESCRIPTION "The number of RADIUS packets of unknown type which were received from this client." ::= { radiusAuthClientEntry 12 } - -- new table + -- New MIB objects added in this revision radiusAuthClientExtTable OBJECT-TYPE SYNTAX SEQUENCE OF RadiusAuthClientExtEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The (conceptual) table listing the RADIUS authentication clients with which the server shares a secret." - ::= { radiusAuthServerExtMIBObjects 1 } + ::= { radiusAuthServ 16 } radiusAuthClientExtEntry OBJECT-TYPE SYNTAX RadiusAuthClientExtEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry (conceptual row) representing a RADIUS authentication client with which the server shares a secret." INDEX { radiusAuthClientExtIndex } @@ -693,32 +698,27 @@ STATUS current DESCRIPTION "The number of RADIUS packets of unknown type which were received from this client." ::= { radiusAuthClientExtEntry 13 } -- conformance information radiusAuthServMIBConformance OBJECT IDENTIFIER ::= { radiusAuthServMIB 2 } + radiusAuthServMIBCompliances OBJECT IDENTIFIER ::= { radiusAuthServMIBConformance 1 } + radiusAuthServMIBGroups OBJECT IDENTIFIER ::= { radiusAuthServMIBConformance 2 } - radiusAuthServExtMIBConformance OBJECT IDENTIFIER - ::= { radiusAuthServerExtMIB 2 } - radiusAuthServExtMIBCompliances OBJECT IDENTIFIER - ::= { radiusAuthServExtMIBConformance 1 } - radiusAuthServExtMIBGroups OBJECT IDENTIFIER - ::= { radiusAuthServExtMIBConformance 2 } - -- compliance statements radiusAuthServMIBCompliance MODULE-COMPLIANCE STATUS deprecated DESCRIPTION "The compliance statement for authentication servers implementing the RADIUS Authentication Server MIB." MODULE -- this module MANDATORY-GROUPS { radiusAuthServMIBGroup } @@ -735,21 +734,21 @@ "The compliance statement for authentication servers implementing the RADIUS Authentication Server MIB." MODULE -- this module MANDATORY-GROUPS { radiusAuthServExtMIBGroup } OBJECT radiusAuthServConfigReset WRITE-SYNTAX INTEGER { reset(2) } DESCRIPTION "The only SETable value is 'reset' (2)." - ::= { radiusAuthServExtMIBCompliances 1 } + ::= { radiusAuthServMIBCompliances 2 } -- units of conformance radiusAuthServMIBGroup OBJECT-GROUP OBJECTS {radiusAuthServIdent, radiusAuthServUpTime, radiusAuthServResetTime, radiusAuthServConfigReset, radiusAuthServTotalAccessRequests, radiusAuthServTotalInvalidRequests, @@ -804,28 +803,27 @@ radiusAuthServExtAccessChallenges, radiusAuthServExtMalformedAccessRequests, radiusAuthServExtBadAuthenticators, radiusAuthServExtPacketsDropped, radiusAuthServExtUnknownTypes } STATUS current DESCRIPTION "The collection of objects providing management of a RADIUS Authentication Server." - ::= { radiusAuthServExtMIBGroups 1 } + ::= { radiusAuthServMIBGroups 2 } END 8. IANA Considerations - This document requires IANA assignment of a number in the MIB-2 OID - number space. + This document requires no new IANA assignments. 9. Security Considerations There are no management objects defined in this MIB that have a MAX- ACCESS clause of read-write and/or read-create. So, if this MIB is implemented correctly, then there is no risk that an intruder can alter or create any management objects of this MIB via direct SNMP SET operations. There are a number of managed objects in this MIB that may contain