Remote Authentication Dial-In User Service (RADIUS) Usage for Simple Network Management Protocol (SNMP) Transport Models
Extracted elements (25)
NAS devices include 'hint' attributes in RADIUS Access-Request messages because RADIUS servers often serve many NAS types and user classes; the server needs context about the type of NAS, the service requested, and the user's role to make correct authorization decisions for SNMP management access.
Provisioning USM access to supplement AAA-based access is recommended as a fallback: when the network is under duress or the AAA service is unreachable, locally stored USM credentials ensure management access remains available — analogous to a local 'root' password when NIS is unavailable.
There is no RADIUS attribute combination equivalent to SNMP noAuthNoPriv access because RADIUS always requires user authentication as a prerequisite to authorization. RADIUS Authorize-Only service is only available when the request includes a State Attribute cookie from a prior successful authentication.
Two distinct use cases for RADIUS with SNMP are identified: (a) service authorization and (b) access control authorization. Only service authorization is specified in this document; access control authorization is deferred as a research topic.
If SNMPv1 or SNMPv2c security model is used, securityName comes from the community name per RFC 3584. If USM is selected, securityName is determined using USM. These behaviors may not be expected when using an SNMP secure Transport Model with RADIUS.
RADIUS has no support for public key authentication except within the context of an EAP Method. Password is the most common compatible RADIUS authentication method for use with secure transports such as SSH.
Traditional SSH server implementations obtain service authorization via OS-level access controls (shell, filesystem) tied to the username rather than from RADIUS service provisioning. Adapting SSH servers for SNMP Transport Models requires that RADIUS service authorization information be passed from the SSH module to the relevant SNMP models.
A NAS compliant to this specification MUST treat any RADIUS Access-Accept message that provisions a level of transport protection or application service that cannot be provided as if an Access-Reject message had been received instead.
NASes compliant to this specification MUST use RADIUS service provisioning attributes when present in an Access-Accept message to determine whether a session can be created, and MUST enforce those service provisioning decisions.
NASes MUST enforce implicitly mandatory attributes such as Service-Type within an Access-Accept message, and MUST treat Access-Accept messages that attempt to provision unsupported services as if they were an Access-Reject.
NASes SHOULD treat unknown attributes as if they were provisioning unsupported services, effectively causing the access request to be rejected.
RADIUS servers compliant to this specification MUST use RADIUS service provisioning attributes to specify SNMP access over a secure transport, and MAY use 'hint' attributes from the Access-Request when determining what service to provision.
The following RADIUS attributes MUST be used as 'hint' attributes in the Access-Request to signal authPriv SNMP: Service-Type=Framed-Management, Framed-Management-Protocol=SNMP, and Management-Transport-Protection=Integrity-Confidentiality-Protection.
The integration of RADIUS clients with transport protocols MUST utilize appropriate 'hint' attributes in RADIUS Access-Request messages to signal to the RADIUS server the type of service being requested over the transport session.
The same three RADIUS attributes (Service-Type=Framed-Management, Framed-Management-Protocol=SNMP, Management-Transport-Protection=Integrity-Confidentiality-Protection) MUST be present in an Access-Accept message to provision SNMP authPriv over a secure transport.
The secure transport protocol and its NAS implementation MUST support credential forms compatible with the authentication methods supported by RADIUS (Password, CHAP, ARAP, EAP, or HTTP Digest).
The use of EAP with SNMP Transport Models is NOT RECOMMENDED, as the applicability statement for EAP indicates it is not intended for use as an application-layer authentication mechanism.
To authorize SNMP authNoPriv, the three RADIUS attributes MUST optionally be used with Management-Transport-Protection=No-Protection; there is no RADIUS combination equivalent to noAuthNoPriv since RADIUS always requires user authentication.
Session-Timeout and Inactivity-Timeout RADIUS attributes are used to limit the extent of a secure transport session carrying SNMP traffic. Session-Timeout sets the maximum session duration in seconds; Inactivity-Timeout sets the maximum idle time before disconnection.
The RADIUS Service-Type Attribute is the primary indicator of the service being provisioned in an Access-Accept message, supplemented by Framed-Management-Protocol and Management-Transport-Protection attributes defined in RFC 5607.
The Transport Model maps the authenticated identity to a model-independent principal stored in tmStateReference. When the Transport Security Model (TSM) is selected, securityName is set from the authenticated principal information in tmStateReference.
In the absence of RADIUS-provisioned service authorization, network management access may be granted to users who are properly authenticated but not authorized for SNMP management. In many RADIUS deployments, the backend database holds credentials for many user classes, only a small subset of which should have management access.
Simultaneously using a secure transport with RADIUS authentication/authorization and the SNMPv1, SNMPv2c, or USM security models is NOT RECOMMENDED, per the coexistence and security parameters guidance in RFC 5590.
The Message-Authenticator Attribute (80) SHOULD be used with RADIUS messages described in this memo because it provides the best available tamper-evident integrity protection for service provisioning attributes in Access-Accept packets, mitigating the risk of attribute addition, deletion, or modification by an adversary.
Table 1 defines the per-packet attribute cardinality: User-Name (1), User-Password (2), NAS-IP-Address (4), NAS-IPv6-Address (95), NAS-Identifier (32), Service-Type (6), State (24), Session-Timeout (27), Idle-Timeout (28), Message-Authenticator (80), Framed-Management-Protocol (133), Management-Transport-Protection (134). Attributes 133 and 134 appear in Access-Request and Access-Accept only.