Subject: RE: [Syslog] Re: Threat model and charter

From: "Rainer Gerhards" <[email-masked]>
Date: Wed, 18 Jan 2006 09:11:36 +0100

Chris, 

> I have not heard back from anyone about how SSL is currently being 
> implemented for syslog.  From that, I might conclude that message 
> confidentiality is not a priority for the community.  
> (Responses to that 
> would be welcome.)

I thought that these postings pointed out what is done:

http://www.mail-archive.com/syslog%40lists.ietf.org/msg00421.html
http://www.mail-archive.com/syslog%40lists.ietf.org/msg00420.html
http://www.mail-archive.com/syslog%40lists.ietf.org/msg00432.html
http://www.mail-archive.com/syslog%40lists.ietf.org/msg00411.html

You might also want to review some of these documents:
http://www.stunnel.org/examples/syslog-ng.html
http://freshmeat.net/articles/view/1781/

Rainer

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Chris Lonvick <[email-masked]>
Date: Wed, 18 Jan 2006 06:24:56 -0800 (PST)

Hi Rainer,

I'm still not seeing too many responses about how TLS is authenticated. 
Only Baszi has said that full X.509 certificates should be used - similar 
to how they are used in stunnel.  Is this acceptable to the WG?  Should 
the WG also consider using PSKs as proposed in RFC 4279?

Having authenticated TLS will address many of the threats described in RFC 
3164.  Is this how the Working Group wants to proceed?  I'd like to hear 
from more people on this.

Thanks,
Chris

---

From: Balazs Scheidler <[email-masked]>
Date: Wed, 18 Jan 2006 17:16:28 +0100

> from more people on this.

Maybe I was not completely clear. I think we should go the TLS route and
let the operator decide whether he wants authenticated or
unauthenticated TLS (or asymmetric authentication, e.g. the server is
authenticated but the client is not just like in HTTPS) So I fully agree
with Rainer on this one.

-- 
Bazsi

---

From: Darren Reed <[email-masked]>
Date: Sat, 21 Jan 2006 01:07:10 +1100 (EST)

Chris,

> from more people on this.

I think supporting TLS and all of its authentication options is what
we should do in our documentation.  Or to put it another way, we
shouldn't worry ourselves with restricting use of TLS to a particular
authentication model, be it PSK or X.509 or something else.

What we should be doing is letting systems people use whatever they
feel comfortable with and are already deploying...which makes me
think, we need to be saying "authentiation style(s) X must be included",
to set a minimum level of interoperability between all implementations.

I believe that minimum level should be PSK as anything certificate
orientated can quickly become complicated, not just for management
but initial use.

So to express this in RFC terms, TLS PSK MUST be supported,
TLS .... SHOULD be supported, TLS ......

Darren