Subject: [Syslog] Secure substrate - need your input

From: Chris Lonvick <[email-masked]>
Date: Mon, 24 Oct 2005 06:04:13 -0700 (PDT)

Hi Folks,

I'll be asking this in Vancouver but would like to get some input from the 
mailing list.

Our charter says that we will develop a secure method to transport syslog 
messages.  We have BEEP (RFC 3195) but it has a low implementation record. 
Other groups have specified BEEP as well but are also moving along towards 
using SSH or SSL.

1) What secure substrate should the WG look towards:

__  ssl

__  ssh

__  dtls  http://www.ietf.org/internet-drafts/draft-rescorla-dtls-05.txt

__  other

2) Why?

Thanks,
Chris

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Rodney Thayer <[email-masked]>
Date: Mon, 24 Oct 2005 09:43:02 -0700

Chris Lonvick wrote:
> Hi Folks,
> 
> I'll be asking this in Vancouver but would like to get some input from 
> the mailing list.
> 
> Our charter says that we will develop a secure method to transport 
> syslog messages.  We have BEEP (RFC 3195) but it has a low 
> implementation record. Other groups have specified BEEP as well but are 
> also moving along towards using SSH or SSL.
> 
> 

you should never add a new substrate.  The IETF re-invents things way
too often.  Any proposal should be required to justify not using some
pre-existing scheme (TLS, SSH, IPSec, whatever)

> 2) Why?

Because it's hard enough to get vendors to implement this stuff
and if they already have one or more security mechanisms implemented
it's architecturally irresponsible to ask them to add another one
without a significant amount of justification.

---

From: "Tom Petch" <[email-masked]>
Date: Tue, 25 Oct 2005 12:31:42 +0200

---- Original Message -----
From: "Chris Lonvick" <[email-masked]>
To: <[email-masked]>
Sent: Monday, October 24, 2005 3:04 PM
Subject: [Syslog] Secure substrate - need your input

> __  dtls  http://www.ietf.org/internet-drafts/draft-rescorla-dtls-05.txt
SSH; before the isms WG came into existence, there was a survey of operators to
find why SNMPv3 security was unacceptable and that showed that the most used
security was ssh; tls did not figure.  This makes sense to me as SSH is widely
used with telnet to control remote network devices - I do not see much (d)tls in
this area.

And, after due deliberation, netconf chose SSH.  Having it in use by three
working groups in the operations area seems the right thing.

Downside is the use of a reliable transport, in practice TCP, which then brings
a load of unnecessary baggage (mmm I think the IETF is missing a few transport
protocol options).

dtls sounds fine, and if it is in widespread use in five years time in this
environment, then it would have been the right choice but at present, it is a
gamble which I do not want to take.

Tom Petch