Subject: [Syslog] TCP and SSH Discussion

From: Chris Lonvick <[email-masked]>
Date: Thu, 20 Oct 2005 06:51:27 -0700 (PDT)

Hi,

Our charter says:

    At a minimum this group will address providing authenticity, integrity
    and confidentiality of Syslog messages as they traverse the network.

If the WG feels that an SSH transport will accomplish this goal, and it 
will be used, then I'm open to having that discussion.  I don't feel that 
documenting current tcp transports works towards that goal.  I've heard a 
few voices say that they would support an SSH transport on the mailing 
list.  Does anyone object or have a differing view?  (We will have this as 
a topic in Vancouver as well.)  If we agree to move forward with this then 
we will need someone to write the document.  Volunteers?

We do have BEEP as a transport and I've received some email from a few 
people saying that they are using both the RAW and COOKED modes.  Can I 
get someone who has implemented it to update RFC 3195?

Thanks,
Chris

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "David B Harrington" <[email-masked]>
Date: Thu, 20 Oct 2005 10:07:58 -0400

Hi,

For a discussion of syslog over SSH, I recommend people read the
documents for other IETF network management protocols that plan to run
over SSH:

http://www.ietf.org/internet-drafts/draft-ietf-netconf-ssh-05.txt and
http://www.ietf.org/internet-drafts/draft-ietf-isms-secshell-00.txt 

http://www.ietf.org/internet-drafts/draft-ietf-isms-tmsm-00.txt also
deals with some issues related to moving a management protocol from
UDP to TCP and sessions (but mostly is about backwards compatibility
with the SNMPv3 architecture and access control).

David Harrington
[email-masked]
 
> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Chris Lonvick
> Sent: Thursday, October 20, 2005 9:51 AM
> To: [email-masked]
> Subject: [Syslog] TCP and SSH Discussion
> 
> Hi,
> 
> Our charter says:
>

---

From: Darren Reed <[email-masked]>
Date: Fri, 21 Oct 2005 18:55:03 +1000 (EST)

> documenting current tcp transports works towards that goal.

The only concern I'd have would be syslog being _only_ UDP over ssh.
But then if SNMP is operating in this manner, I'm much less concerned
about it being a problem of any kind.  If there are 4 different TCP
transports for syslog out there, it might be worth trying to get them
to converge and be interoperable.  If the number can be reduced to 1
or 2, and this represents a sizable portion of the syslog over TCP
install base, I think it behooves us have that protocol published.
This might be something to push back on the implementors of said
protocol(s).
 
> I've heard a 
> list.  Does anyone object or have a differing view?

I'd add that we should look at supporting both TCP and UDP transports
to the ssh endpoint but also, see the above.  Using ssh is clearly a
winning proposition at this piont in time.

Darren

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 21 Oct 2005 08:38:37 -0400

Hi,

Comments inline 

> This might be something to push back on the implementors of said

I am  not aware of an SSH-over-UDP standard; an SSH transport runs
over TCP. Establishing the TCP connection is part of the SSH standard.

http://www.ietf.org/internet-drafts/draft-ietf-secsh-transport-24.txt:
"This document describes the SSH transport layer protocol which
   typically runs on top of TCP/IP.  The protocol can be used as a
basis
   for a number of secure network services.  It provides strong
   encryption, server authentication, and integrity protection.  It
may
   also provide compression."

When SNMP runs over SSH, it is over an SSH/TCP transport. It is not
running over UDP:
http://www.ietf.org/internet-drafts/draft-ietf-isms-secshell-00.txt

> winning proposition at this piont in time.

I don't think the SecSH WG has any plans to run SSH over UDP at this
time.

David Harrington
[email-masked]

---

From: Chris Lonvick <[email-masked]>
Date: Fri, 21 Oct 2005 05:43:47 -0700 (PDT)

Hi Darren,

It's not "syslog/udp/ssh" nor "syslog/tcp/ssh", it's going to be 
"syslog/ssh/tcp/ip".  syslog will be a defined subsystem for SSH much like 
sftp and netconf.

SSH subsystems are described here:
http://www.employees.org/~lonvick/secsh-wg/2005-sep-07/draft-ietf-secsh-connect-26.txt

SFTP is here:
   http://www.ietf.org/internet-drafts/draft-ietf-secsh-filexfer-10.txt
netconf/ssh is here
   http://www.ietf.org/internet-drafts/draft-ietf-netconf-ssh-05.txt

Are you volunteering to write?  :)

Thanks,
Chris

---

From: Darren Reed <[email-masked]>
Date: Sat, 22 Oct 2005 12:48:46 +1000 (EST)

> "syslog/ssh/tcp/ip".  syslog will be a defined subsystem for SSH much like 

Oh! Hmmm.

Do you have any links to critiques about sftp ?

I've spoken to at least one person recently (but I can't recall *who*)
that wasn't too impressed with sftp, so I'm curious if there is anything
substantial that discusses its drawbacks and what lessons (if any) need
to be learnt from it.

Darren

---

From: Chris Lonvick <[email-masked]>
Date: Sun, 23 Oct 2005 18:02:44 -0700 (PDT)

Hi Darren,

> Do you have any links to critiques about sftp ?

The secsh wg mailing list.  ;) 
ftp://ftp.ietf.org/ietf-mail-archive/secsh/

> substantial that discusses its drawbacks and what lessons (if any) need

Joseph Galbriath has offered to have a bar-bof to discuss sftp.

Thanks,
Chris