Subject: [netmod] sshd_config example

From: Andy Bierman <[email-masked]>
Date: Wed, 23 Sep 2009 08:38:31 -0700

Hi,

One implementation choice for a NETCONF server running
on linux is to run a 'thin client' between the OpenSSH 'sshd'
server and the NETCONF server.

When adding the thin-client subsystem to the sshd_config file,
a 'Port 830' command needs to be added, or sshd will
not listen on port 830 for any connections.

If no Port command is given, then only port 22 will be used by sshd.

But if the NETCONF server adds 'Port 830', the sshd server will
not listen on port 22 anymore.  Both 'Port 22' and 'Port 830'
need to be specified to get the desired results.  In a config file,
the Port command can appear multiple times, even duplicates.

   leaf-list Port {
     description
      "TCP ports that sshd will listen for new connections.";
     type inet:port-number;
     default 22;    // if client does not set any ports,
                    // then there will be 1 data node == 22
                    // if the client sets any ports, the
                    // default will not be used anymore
   }

YANG does not actually support this semantics for leaf-list
of course, but maybe it should allow the default-stmt,
with the same sort of semantics as used by sshd.

As for retrieval operations on <Port>,
a generalized automation-focused application wants
to retrieve the port number(s) that can be used,
not guess at the values in use.

The CLI-focused way is say there is no instance of <Port>
if the server creates the default, and the
operator 'knows' that.  IMO, it is better to use
a few milliseconds of CPU time to be sure, especially if
there is reason to think the server behavior
could be the cause of a network outage.

Andy

---

From: Andy Bierman <[email-masked]>
Date: Wed, 23 Sep 2009 10:22:06 -0700

> Hi,

I forgot to point out that this unix use-case is more
the exception than the rule -- I'm not sure how important
it really is to YANG.

But it shows that the SSH server will treat a client-set
Port command and a server-set Port command very differently.
and treating the default as if it were config=true in this
case would not be consistent with the intended system behavior.

(I.e., when client adds a Port command, this needs to replace the
default, not add another node to the leaf-list. I don't
see much difference for a leaf though, other than wasting
space in NV-storage.)

Andy

> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod
>