Subject: RE: Proposed Update to Netconf Charter

From: "Sharon Chisholm" <[email-masked]>
Date: Mon, 11 Jul 2005 09:26:46 -0400

hi

More or less. That and we should ensure that everything plays nice with
a common security infrastructure, rather than each other

                  ___________
SNMP  --------   /           \
               /              \
CLI    -------/                \
              |   Miracle       \
Netconf -------\                |
                |              /
Syslog --------  \             \
                  --------------

As appose to

SNMP <--miracle --> Netconf
CLI  <--miracle --> Netconf
Syslog <--miracle --> Netconf
SNMP <--miracle--> CLI
SNMP <--miracle--> Syslog
CLI  <--miracle--> Syslog

Sharon

-----Original Message-----
From: Juergen Schoenwaelder [mailto:[email-masked]] 
Sent: Monday, July 11, 2005 8:11 AM
To: Chisholm, Sharon [CAR:5K50:EXCH]
Cc: [email-masked]
Subject: Re: Proposed Update to Netconf Charter

On Mon, Jul 11, 2005 at 08:00:57AM -0400, Sharon Chisholm wrote:

> I think the goal with access control should be to try to integrate 
> with existing deployed security solutions, not specifically with SNMP.

> If SNMP succeeds in ISMS, then it will all be integrated without 
> turning the netconf access control mechanisms into VACM.

I have no clue what you are trying to convey here - the ISMS charter is
pretty clear in saying that ISMS is not supposed to touch access control

issues. Perhaps you just wanted to say that NetConf access control
should not be constrained by the way VACM works - something I do agree
with.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen,
Germany

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 11 Jul 2005 16:11:00 +0200

> a common security infrastructure, rather than each other

We have VACM for SNMP and eventually we might have NACM for NETCONF.
There is no agreed access control mechanism for CLIs and syslog and
I think it is therefore out of scope to worry about this in the NETCONF
WG. I also believe that VACM is rather SNMP specific since it relies
on OID naming which luckily does not exist in NETCONF. So these two
do not align well and even if you were to try, you would have to solve
the SNMP naming to NETCONF naming coexistance/mapping problem as part
of the solution.  So I still believe NETCONF needs a good enough
ACM for NETCONF, no more no less. This WG can't solve all the access
control problems out there.

Perhaps the only common denominator is the set of protocol specific
operations an authenticated identity is allowed to perform if you
consider integration. Everything above that which needs to be specific
to the data model and representation will be rather difficult (and
perhaps not even needed for a non-trivial class of operational
environments).

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: Phil Shafer <[email-masked]>
Date: Mon, 11 Jul 2005 10:30:16 -0400

My guess is that miracles will always be outside our charter.

Thanks,
 Phil