Subject: [Syslog] RE: Re: Threat model and charter

From: "Eric Hibbard" <[email-masked]>
Date: Wed, 18 Jan 2006 09:50:27 -0800

> Maybe I was not completely clear. I think we should go the TLS route
and 
> let the operator decide whether he wants authenticated or
> unauthenticated TLS (or asymmetric authentication, e.g. the server is
> authenticated but the client is not just like in HTTPS) So I fully
agree
> with Rainer on this one.
> -- 
> Bazsi

This is a way to go, but it is important to note that the absence of
client-side certificates (authentication) potentially exposes you to
hostile clients attempting to masquerade as a legitimate client. It also
makes it more difficult to guard against man-in-the-middle attacks.

I like the idea of using TLS because it is much lighter weight than
IPsec and it is better understood by a broader group of IT
professionals. In a scenario where all the clients and servers are using
certificates from the same issuing CA, one could also make the argument
that this is the basis of trust, starting at the device, flowing through
relays, and arriving at collectors.

-Eric
 
Eric A. Hibbard, CISSP, ISSAP, ISSMP, ISSEP
Senior Director, Data Networking Technology
Chair, SNIA Security Technical Work Group
 
Office of the CTO
HITACHI DATA SYSTEMS
750 Central Expressway, MS 3407
Santa Clara, CA 95050-2627
P 408.970.7979/ F 408.562.5477
[email-masked]

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Balazs Scheidler <[email-masked]>
Date: Wed, 18 Jan 2006 22:36:55 +0100

> hostile clients attempting to masquerade as a legitimate client. 

_I_ know this, and I would not recommend doing this in any way :) And of
course should be documented in the RFC as well.

> It also makes it more difficult to guard against man-in-the-middle attacks.

If the server is authenticated then MiTM does not apply, does it?

-- 
Bazsi