]> Cisco Systems

sdanda@cisco.com

Cisco Systems

pravijay@cisco.com

Network Working Group Network Management Management Information Base MIB SMIv2 OPSA This draft defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it describes managed objects for managing Locally authenticated users. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14, RFC 2119.

For a detailed overview of the documents that describe the current Internet-Standard Management Framework, please refer to section 7 of RFC 3410. Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. MIB objects are generally accessed through the Simple Network Management Protocol (SNMP). Objects in the MIB are defined using the mechanisms defined in the Structure of Management Information (SMI). This memo specifies a MIB module that is compliant to the SMIv2, which is described in STD 58, RFC 2578, STD 58, RFC 2579 and STD 58, RFC 2580.

Authentication, Authorization and Accounting enables the user to allow the control access to system resources. For small enterprise network deployments that provide network access to hundreds of users, one may not need to have dedicated AAA servers for authenticating the users. For such scenarios, the user information or profiles can be stored locally at the network element. Thus, in that network deployment context, it is useful collect Authentication logs at the network element. This draft defines an portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it describes managed objects to monitor Local authenticated users. Comments should be made directly to the WSPA mailing list at opsawg@ietf.org.

This document adopts the definitions, acronyms and mechanisms described in . Unless otherwise stated, the mechanisms described therein will not be re-described here.

This section describes objects pertaining to Local Authenticated users with specific information related to the MIB module specified in this document. The Local Authenticated MIB has one module named LocalAuthUserMIB which is focussed on describing users authenticated locally by Network Access Server.

The lauUserTable lists the currently configured local users. For each user object, it provides information and statistics about the local users.

| Server |<------>| Network | | | | (NAS) | | | +--------+ +--------+ +---------+ A client is a telnet or SSH user needing access to the NAS box directly. Network user like PPP or dot1x will request NAS box for authentication to access the network. NAS box authenticates user present in the local user database. GLOSSARY Network Access Server ( NAS ) A single point of access to a remote resource and is exclusively used with Authentication, Authorization and Accounting. Point-to-Point Protocol (PPP) A data link protocol commonly used in establishing a direct connection between two networking nodes." REVISION "201305090000Z" DESCRIPTION "Initial version of MIB" ::= { mib-2 XXX } -- Default Notification Type localAuthUserMIBNotifs OBJECT IDENTIFIER ::= { localAuthUserMIB 0 } -- Local authenticated user MIB object definition localAuthUserMIBObjects OBJECT IDENTIFIER ::= { localAuthUserMIB 1 } localAuthUserMIBConform OBJECT IDENTIFIER ::= { localAuthUserMIB 2 } -- Notification Configuration lauNotifEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "This object specifies whether the system generates lauUserAdded, lauUserDeleted, lauUserLoggedIn and lauUserLoggedOut notifications." DEFVAL { false } ::= { localAuthUserMIBObjects 1 } lauUserTable OBJECT-TYPE SYNTAX SEQUENCE OF LauEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table lists the currently configured local users." ::= { localAuthUserMIBObjects 2 } lauUserEntry OBJECT-TYPE SYNTAX LauEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry describes a local user identified by its index. An entry is created or modified when a user is defined in system through configuration. An entry is removed when a user is undefined with configuration commands via CLI or by automatic expiry of users when lifetime of the user is expired." INDEX { lauUserIndex } ::= { lauUserTable 1 } LauEntry ::= SEQUENCE { lauUserIndex Unsigned32, lauUserName SnmpAdminString, lauUserType INTEGER, lauUserCreationTime DateAndTime, lauUserLifetime Unsigned32, lauUserLoginSuccessCount Unsigned32, lauUserLoginFailureCount Unsigned32, lauUserLastLoginTime DateAndTime, lauUserOTPEnabled TruthValue, lauUserPrivelegeLevel Unsigned32, lauUserLoginStatus TruthValue, lauUserDescription OCTET STRING, lauUserPasswordLifetime Unsigned32 } lauUserIndex OBJECT-TYPE SYNTAX Unsigned32 (1..4294967295) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object indicates an integer-value that uniquely identifies a local user." ::= { lauUserEntry 1 } lauUserName OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "A textual string containing the name of the locally authenticated user." ::= { lauUserEntry 2 } lauUserType OBJECT-TYPE SYNTAX INTEGER { defaultUser(1), lobbyUser(2), managementUser(3), networkUser(4), guestUser(5) } MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates the type of local user: defaultUser - Default user account type. lobbyUser - Management user with lobby admin privileges, can create and manage guest user account type. managementUser - Management user account type. networkUser - User requires accessing the network. guestUser - Type of networkUser with lifetime configured such that they can stay alive for a given time period and will expire therafter." ::= { lauUserEntry 3 } lauUserCreationTime OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates the time the local user was created." ::= { lauUserEntry 4 } lauUserLifetime OBJECT-TYPE SYNTAX Unsigned32 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates the expiry duration of the local user; that is, the duration the local user is valid from the creation time." ::= { lauUserEntry 5 } lauUserLoginSuccessCount OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates the number of times, the user logged-in successfully." ::= { lauUserEntry 6 } lauUserLoginFailureCount OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates the number of times, the user failed to authenticate successfully." ::= { lauUserEntry 7 } lauUserLastLoginTime OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates the last time the local user was logged in successfully." ::= { lauUserEntry 8 } lauUserOTPEnabled OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION "This object specifies whether One Time Password is enabled for the user." ::= { lauUserEntry 9 } lauUserPrivelegeLevel OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates the privelege level of the local user." ::= { lauUserEntry 10 } lauUserLoginStatus OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates the current login status of the local user." ::= { lauUserEntry 11 } lauUserDescription OBJECT-TYPE SYNTAX OCTET STRING MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates the description of the local user." ::= { lauUserEntry 12 } lauUserPasswordLifetime OBJECT-TYPE SYNTAX Unsigned32 MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates the expiry duration of the password of the local user." ::= { lauUserEntry 13 } lauMIBCompliances OBJECT IDENTIFIER ::= { localAuthUserMIBConform 1 } lauUserAdded NOTIFICATION-TYPE OBJECTS { lauUserName, lauUserType, lauUserLifetime } STATUS current DESCRIPTION "This notification indicates when the system has added a user." ::= { localAuthUserMIBNotifs 1 } lauUserDeleted NOTIFICATION-TYPE OBJECTS { lauUserName, lauUserType } STATUS current DESCRIPTION "This notification indicates when the system has deleted a user." ::= { localAuthUserMIBNotifs 2 } lauUserLoggedIn NOTIFICATION-TYPE OBJECTS { lauUserName, lauUserType } STATUS current DESCRIPTION "This notification indicates when the user has logged into the system." ::= { localAuthUserMIBNotifs 3 } lauUserLoggedOut NOTIFICATION-TYPE OBJECTS { lauUserName, lauUserType } STATUS current DESCRIPTION "This notification indicates when the user has logged out of the system" ::= { localAuthUserMIBNotifs 4 } lauUserPasswordExpired NOTIFICATION-TYPE OBJECTS { lauUserName, lauUserType } STATUS current DESCRIPTION "This notification indicates when the user password is expired." ::= { localAuthUserMIBNotifs 5 } lauMIBGroups OBJECT IDENTIFIER ::= { localAuthUserMIBConform 2 } lauMIBCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "This is a default module-compliance containing default object groups." MODULE -- this module MANDATORY-GROUPS { lauMIBMainObjectGroup, lauMIBNotificationGroup } ::= { lauMIBCompliances 1 } -- Units of Conformance lauMIBMainObjectGroup OBJECT-GROUP OBJECTS { lauNotifEnable, lauUserType, lauUserCreationTime, lauUserLifetime, lauUserName, lauUserLoginSuccessCount, lauUserLoginFailureCount, lauUserLastLoginTime, lauUserOTPEnabled, lauUserPrivelegeLevel, lauUserLoginStatus, lauUserDescription, lauUserPasswordLifetime } STATUS current DESCRIPTION "The is a local Authenticated User MIB Main Object group." ::= { lauMIBGroups 1 } lauMIBNotificationGroup NOTIFICATION-GROUP NOTIFICATIONS { lauUserAdded, lauUserDeleted, lauUserLoggedIn, lauUserLoggedOut, lauUserPasswordExpired } STATUS current DESCRIPTION "The is a local Authenticated User MIB Notification group." ::= { lauMIBGroups 2 } END ]]>

It is important to control GET access to these objects and possibly to even encrypt the values of these object when sending them over the network via SNMP. Not all versions of SNMP provide features for such a secure environment. SNMP versions prior to SNMPv3 did not include adequate security. Even if the network itself is secure "for example by using IPSec", even then, there is no control as to who on the secure network is allowed to access and GET/SET "read/change/create/delete" the objects in these MIB modules. It is RECOMMENDED that implementers consider the security features as provided by the SNMPv3 framework (see RFC3410, section 8), including full support for the SNMPv3 cryptographic mechanisms "for authentication and privacy". Further, deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to enable cryptographic security. It is then a customer/operator responsibility to ensure that the SNMP entity giving access to an instance of this MIB module, is properly configured to give access to the objects only to those principals "users" that have legitimate rights to indeed GET or SET "change/create/delete" them.

[Editor's Note (to be removed prior to publication): the IANA is requested to assign a value for "XXX" under the 'mib-2' subtree and to record the assignment in the SMI Numbers registry. When the assignment has been made, the RFC Editor is asked to replace "XXX" (here and in the MIB module) with the assigned value and to remove this note.]

Authors would like to thank Mouli Chandramouli, Peddareddappa Gonichettipalli, Arun Kudur, Naresh Sunkara and Biju Raju for their comments and suggestions.