Subject: RE: Evaluation: draft-ietf-netconf-ssh-05.txt to Proposed Standar d [I06-051127-0011]

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Thu, 16 Mar 2006 00:19:33 +0100

But am amswer of "it doies not matter" does not help the IANA
to make an assignment. We as a WG must choose. If it does not
matter, then I guess we're saying >1024.

Bert

> -----Original Message-----
> From: Phil Shafer [mailto:[email-masked]]
> Sent: Thursday, March 16, 2006 00:15
> To: Wijnen, Bert (Bert)
> Cc: 'Margaret Wasserman (E-mail)'; Andy Bierman (E-mail); 'Netconf
> (E-mail)'; [email-masked]; IANA
> Subject: Re: Evaluation: draft-ietf-netconf-ssh-05.txt to Proposed
> Standar d [I06-051127-0011] 
> 
> 
> The only reason to have it <1024 is to keep unix users from running
> it as non-root.  While this is fairly weak security, it does prevent
> untrusted users on trusted hosts (whose host-key your client likes)
> from starting a process that mimics the real ssh-based netconf daemon
> and skims whatever information it can.  Then again, I guess you'd
> need to be root to have the private version of the host key, so
> it's not really an issue.
> 
> So IMHO it doesn't matter.
> 
> Thanks,
>  Phil
> 
> 
> 
> "Wijnen, Bert (Bert)" writes:
> >I was trying to find the answer to this IANA quesion,
> >and I cannot find it. Did we (WG) decide what we want?
> >
> >I need to know BEFORE the IESG telechat (11:30 EST) tomorrow 
> (thursday)
> >if possible.
> >
> >Bert
> >
> >> -----Original Message-----
> >> From: [email-masked] 
[mailto:[email-masked]]On
>> Behalf Of IANA
>> Sent: Tuesday, February 28, 2006 18:44
>> To: 'Wijnen, Bert (Bert)'
>> Cc: 'Margaret Wasserman (E-mail)'; 'Netconf (E-mail)';
>> [email-masked]
>> Subject: RE: Evaluation: draft-ietf-netconf-ssh-05.txt to Proposed
>> Standard [I06-051127-0011]
>> 
>> 
>> Bert,
>> 
>> I still don't see what range the port needs to go in...
>> User (0-1023) or system (1024-49151) range?
>> 
>> Am I missing a note somewhere that give this information?
>> 
>> Thanks,
>> 
>> Michelle
>> IANA
>
>--
>to unsubscribe send a message to [email-masked] with
>the word 'unsubscribe' in a single line as the message text body.
>archive: <http://ops.ietf.org/lists/netconf/>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>

---

From: Andy Bierman <[email-masked]>
Date: Wed, 15 Mar 2006 15:31:06 -0800

> matter, then I guess we're saying >1024.

Eliot did answer this -- we want a port number < 1024

> Bert

Andy

---

From: Phil Shafer <[email-masked]>
Date: Wed, 15 Mar 2006 21:40:10 -0500

>matter, then I guess we're saying >1024.

Sorry, that was what I meant.  If it doesn't matter to the
netconf protocol, we shouldn't be eating the relatively
scarce resource.  Especially three of them.

Thanks,
 Phil

---

From: Andy Bierman <[email-masked]>
Date: Wed, 15 Mar 2006 19:19:44 -0800

> scarce resource.  Especially three of them.

I see your point.
AFAIK, the WG never discussed the need for a port number < 1024
in any detail.  Since our authorization schemes don't rely on a system
port number to work ;-) and the WG never specifically decided this issue,
we should revisit this question.

Why do we need system port numbers?
If we don't, then Phil is right, we should get numbers > 1024.
(Eliot, do you have a response?)

Andy

---

From: Eliot Lear <[email-masked]>
Date: Thu, 16 Mar 2006 08:53:18 -0800

Sorry- we are talking about CONFIGURATION OF THE DEVICE.  WHAT BETTER
REASON TO MAKE THE PORT PRIVILEGED?!!

Eliot

---

From: Andy Bierman <[email-masked]>
Date: Thu, 16 Mar 2006 11:02:02 -0800

> REASON TO MAKE THE PORT PRIVILEGED?!!

I guess you feel strongly about it then?  ;-)

Most of the WG doesn't seem to care either way.

The most compelling reason not to use a system port number is
to save them for the future.  Simon pointed out there are about 312 such
port numbers left.  The difference between 309 and 312 isn't very 
compelling.

IMO, since CLI over SSH is by default on a system port, then NETCONF 
over SSH
should do the same.  SOAP and BEEP mappings should be in the same range as
the SSH mapping, to be consistent.  (The default for SOAP over HTTPS is
a system port, as well as SOAP over BEEP.)   This would be consistent
with best current practice for CLI.

This seems to be more compelling logic than saving 3 system port numbers.

Unless there any strong objections,  we will ask for port numbers < 1024.

Andy

---

From: Eliot Lear <[email-masked]>
Date: Thu, 16 Mar 2006 11:06:09 -0800

> I guess you feel strongly about it then?  ;-)

VERY coffee deprived this morning.

Eliot