Subject: [Syslog] -transport-tls-12, IP addresses

From: "Rainer Gerhards" <[email-masked]>
Date: Wed, 7 May 2008 22:39:37 +0200

Joe,

   [Editor's Note: How useful is it to match against IP address?  Do we
   expect deployments to issue certificates with IP addresses in them?
   Are IP addresses typically used in configuration? ]

I find this a tough question. In my experience, it is not uncommon to
configure forwarding via IP addresses instead of hostnames. One reason
for this is because of reliability of the logging system when DNS is not
(yet --> system startup) available. On the other hand, I find it even a
bit disturbing to have a certificate issued for an IP address. But it
may make sense. I personally would expect that operators tend to use
hostnames inside the certificate. The problem, of course, would be that
the configuration then needs both the name and IP address...

I hope this is useful information, even though I am undecided.

Rainer
_______________________________________________
Syslog mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/syslog

---

From: "Moehrke, John (GE Healthcare)" <[email-masked]>
Date: Wed, 7 May 2008 17:01:50 -0400

Neither IP address nor hostname are poor identities. The normal TLS
validation proof of possession of the private key is far stronger. I
would recommend against requiring IP address or hostname checking. 

Further I am disturbed at the overly prescriptiveness of this
specification. There is no need to include policy decisions like key
management in this specification.

John

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
Behalf
> Of Rainer Gerhards
> Sent: Wednesday, May 07, 2008 3:40 PM
> To: [email-masked]
> Subject: [Syslog] -transport-tls-12, IP addresses
> 
> Joe,
>

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Thu, 8 May 2008 13:13:37 -0700

> 
> Neither IP address nor hostname are poor identities. The 
> normal TLS validation proof of possession of the private key 
> is far stronger. I would recommend against requiring IP 
> address or hostname checking. 
> 
[Joe] Are advocating use of certificate fingerprints (second option)? 

> specification. There is no need to include policy decisions 
> like key management in this specification.
> 
[Joe] Can you elaborate on this a bit?  What text do you find
problematic?

> > (yet --> system startup) available. On the other hand, I 
> find it even
> a

---

From: "tom.petch" <[email-masked]>
Date: Fri, 9 May 2008 13:54:28 +0200

I think that we should allow IP addresses.  At the entry level network box, I
think that they are widely used.

Tom Petch

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Sun, 11 May 2008 21:15:42 -0700

Hi Tom,

How would you think this would be deployed?  In order for an IP address
match to be secure in most environments the IP address in the
configuration of the transport sender  would have to match against an IP
address in a subject field within the certificate. Would it be
reasonable for a syslog receiver to have a certificate issued to it that
has its IP address in a subject field? 

Joe  

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of tom.petch
> Sent: Friday, May 09, 2008 4:54 AM
> To: Rainer Gerhards; [email-masked]
> Subject: Re: [Syslog] -transport-tls-12, IP addresses
> 
> I think that we should allow IP addresses.  At the entry 
> level network box, I think that they are widely used.
> 
> Tom Petch
> 
> 
> > for this is because of reliability of the logging system 
> when DNS is 
> > not (yet --> system startup) available. On the other hand, 
> I find it 
> > even a bit disturbing to have a certificate issued for an 
> IP address. 
> > But it may make sense. I personally would expect that 
> operators tend 
> > to use hostnames inside the certificate. The problem, of 
> course, would 
> > be that the configuration then needs both the name and IP address...
> >

---

From: "tom.petch" <[email-masked]>
Date: Tue, 13 May 2008 11:36:43 +0200

<inline>
Tom Petch

----- Original Message -----
From: "Joseph Salowey (jsalowey)" <[email-masked]>
To: "tom.petch" <[email-masked]>; "Rainer Gerhards"
<[email-masked]>; <[email-masked]>
Sent: Monday, May 12, 2008 6:15 AM
Subject: RE: [Syslog] -transport-tls-12, IP addresses

Hi Tom,

<tp>
yes, I do think that it would be reasonable:-)

It comes back to the environment in which I see syslog, of large numbers of low
function devices with little infrastructure.  Gold standard security needs PKI,
CRLs, (secure) DNS etc which is great for full function devices.  Entry level
security operates with IP addresses - which must already be known to the syslog
originator - and shared certs, self-signed certs, +/- fingerprints etc so I
think that IP address as an identity should be allowed.

Tom Petch
</tp>

Joe