RADIUS Dynamic Authorization Server MIB
RFC 4673

quot;
       ::= { radiusDynAuthServerMIBGroups 2 }

radiusDynAuthServerNoSessGroup OBJECT-GROUP
       OBJECTS { radiusDynAuthServDisconNakSessNoContext,
                 radiusDynAuthServCoANakSessNoContext
               }
       STATUS  current
       DESCRIPTION
             "The collection of objects supporting the RADIUS
              messages that are referring to non-existing sessions."
       ::= { radiusDynAuthServerMIBGroups 3 }

END

De Cnodder, et al.           Informational                     [Page 19]
RFC 4673        RADIUS Dynamic Authorization Server MIB   September 2006

5.  Security Considerations

   There are no management objects defined in this MIB module that have
   a MAX-ACCESS clause of read-write and/or read-create.  So, if this
   MIB module is implemented correctly, then there is no risk that an
   intruder can alter or create any management objects of this MIB
   module via direct SNMP SET operations.

   Some of the readable objects in this MIB module (i.e., objects with a
   MAX-ACCESS other than not-accessible) may be considered sensitive or
   vulnerable in some network environments.  It is thus important to
   control even GET and/or NOTIFY access to these objects and possibly
   to even encrypt the values of these objects when sending them over
   the network via SNMP.  These are the tables and objects and their
   sensitivity/vulnerability:

   radiusDynAuthClientAddress and radiusDynAuthClientAddressType

      These can be used to determine the address of the DAC with which
      the DAS is communicating.  This information could be useful in
      mounting an attack on the DAC.

   radiusDynAuthServerIdentifier

      This can be used to determine the Identifier of the DAS.  This
      information could be useful in impersonating the DAS.

   SNMP versions prior to SNMPv3 did not include adequate security.
   Even if the network itself is secure (for example by using IPsec),
   even then, there is no control as to who on the secure network is
   allowed to access and GET/SET (read/change/create/delete) the objects
   in this MIB module.

   It is RECOMMENDED that implementers consider the security features as
   provided by the SNMPv3 framework (see [RFC3410], section 8),
   including full support for the SNMPv3 cryptographic mechanisms (for
   authentication and privacy).

   Further, deployment of SNMP versions prior to SNMPv3 is NOT
   RECOMMENDED.  Instead, it is RECOMMENDED to deploy SNMPv3 and to
   enable cryptographic security.  It is then a customer/operator
   responsibility to ensure that the SNMP entity giving access to an
   instance of this MIB module is properly configured to give access to
   the objects only to those principals (users) that have legitimate
   rights to indeed GET or SET (change/create/delete) them.

De Cnodder, et al.           Informational                     [Page 20]
RFC 4673        RADIUS Dynamic Authorization Server MIB   September 2006

6.  IANA Considerations

   The IANA has assigned OID number 146 under mib-2.

7.  Acknowledgements

   The authors would like to acknowledge the following people for their
   comments on this document: Bernard Aboba, Alan DeKok, David Nelson,
   Anjaneyulu Pata, Dan Romascanu, Juergen Schoenwaelder, Greg Weber,
   Bert Wijnen, and Glen Zorn.

8.  References

8.1.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC2578]  McCloghrie, K., Perkins, D., and J. Schoenwaelder,
              "Structure of Management Information Version 2 (SMIv2)",
              STD 58, RFC 2578, April 1999.

   [RFC2579]  McCloghrie, K., Perkins, D., and J. Schoenwaelder,
              "Textual Conventions for SMIv2", STD 58, RFC 2579, April
              1999.

   [RFC2580]  McCloghrie, K., Perkins, D., and J. Schoenwaelder,
              "Conformance Statements for SMIv2", STD 58, RFC 2580,
              April 1999.

   [RFC3411]  Harrington, D., Presuhn, R., and B. Wijnen, "An
              Architecture for Describing Simple Network Management
              Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
              December 2002.

   [RFC3576]  Chiba, M., Dommety, G., Eklund, M., Mitton, D., and B.
              Aboba, "Dynamic Authorization Extensions to Remote
              Authentication Dial In User Service (RADIUS)", RFC 3576,
              July 2003.

   [RFC4001]  Daniele, M., Haberman, B., Routhier, S., and J.
              Schoenwaelder, "Textual Conventions for Internet Network
              Addresses", RFC 4001, February 2005.

De Cnodder, et al.           Informational                     [Page 21]
RFC 4673        RADIUS Dynamic Authorization Server MIB   September 2006

8.2.  Informative References

   [RFC2865]  Rigney, C., Willens, S., Rubens, A., and W. Simpson,
              "Remote Authentication Dial In User Service (RADIUS)", RFC
              2865, June 2000.

   [RFC3410]  Case, J., Mundy, R., Partain, D., and B. Stewart,
              "Introduction and Applicability Statements for Internet-
              Standard Management Framework", RFC 3410, December 2002.

   [RFC4668]  Nelson, D., "RADIUS Authentication Client MIB for IPv6",
              RFC 4668, August 2006.

   [RFC4669]  Nelson, D., "RADIUS Authentication Server MIB for IPv6",
              RFC 4669, August 2006.

   [RFC4670]  Nelson, D., "RADIUS Accounting Client MIB for IPv6", RFC
              4670, August 2006.

   [RFC4671]  Nelson, D., "RADIUS Accounting Server MIB for IPv6", RFC
              4671, August 2006.

   [RFC4672]  De Cnodder, S., Jonnala, N., and M. Chiba, "RADIUS Dynamic
              Authorization Client MIB", RFC 4672, September 2006.

De Cnodder, et al.           Informational                     [Page 22]
RFC 4673        RADIUS Dynamic Authorization Server MIB   September 2006

Authors' Addresses

   Stefaan De Cnodder
   Alcatel
   Francis Wellesplein 1
   B-2018 Antwerp
   Belgium

   Phone: +32 3 240 85 15
   EMail: stefaan.de_cnodder@alcatel.be

   Nagi Reddy Jonnala
   Cisco Systems, Inc.
   Divyasree Chambers, B Wing, O'Shaugnessy Road
   Bangalore-560027, India

   Phone: +91 94487 60828
   EMail: njonnala@cisco.com

   Murtaza Chiba
   Cisco Systems, Inc.
   170 West Tasman Dr.
   San Jose CA, 95134

   Phone: +1 408 525 7198
   EMail: mchiba@cisco.com

De Cnodder, et al.           Informational                     [Page 23]
RFC 4673        RADIUS Dynamic Authorization Server MIB   September 2006

Full Copyright Statement

   Copyright (C) The Internet Society (2006).

   This document is subject to the rights, licenses and restrictions
   contained in BCP 78, and except as set forth therein, the authors
   retain all their rights.

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at
   ietf-ipr@ietf.org.

Acknowledgement

   Funding for the RFC Editor function is provided by the IETF
   Administrative Support Activity (IASA).

De Cnodder, et al.           Informational                     [Page 24]