Subject: RE: Evaluation: draft-ietf-netconf-ssh-05.txt to Proposed Standar d [I06-051127-0011]

From: "McDonald, Ira" <[email-masked]>
Date: Thu, 16 Mar 2006 11:03:23 -0800

Hi Sharon, Eliot, et al,

You've all misreprented the choices - actual options are:

(1) IANA-assigned "Well Known Port" (0 to 1023)
    - approximately 70% are now assigned 
    - very scarce resource

(2) IANA-assigned "Registered Port" (1024 to 49151)
    - approximately %12 are now assigned 
    - plentiful resource

(3) Unregistered "Dynamic or Private Port" (49152 to 65535)
    - not a reasonable choice for NetConf or any standard service

Option (2) is obviously the prudent choide.

It is not possible to use NetConf (or SHOULD NOT be) without
strong authentication - in any case, security professionals
do NOT accept the pseudo-security of "well known ports" based
on their numeric values.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Blue Roof Music / High North Inc
PO Box 221  Grand Marais, MI  49839
phone: +1-906-494-2434
email: [email-masked]

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of Sharon Chisholm
> Sent: Thursday, March 16, 2006 1:20 PM
> To: Netconf (E-mail)
> Subject: RE: Evaluation: draft-ietf-netconf-ssh-05.txt to Proposed
> Standar d [I06-051127-0011]
> 
> 
> hi
> 
> Just to clarify, the options are the following?
> 
> 1) Standards assignment < 1024
> 2) Informal assignment > 1023
> 3) Say nothing
> 
> Sharon
> 
> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On
> Behalf Of Eliot Lear
> Sent: Thursday, March 16, 2006 11:53 AM
> To: Andy Bierman
> Cc: Phil Shafer; Wijnen, Bert (Bert); 'Margaret Wasserman (E-mail)';
> 'Netconf (E-mail)'; [email-masked]; IANA
> Subject: Re: Evaluation: draft-ietf-netconf-ssh-05.txt to Proposed
> Standar d [I06-051127-0011]
> 
> 
> Sorry- we are talking about CONFIGURATION OF THE DEVICE.  WHAT BETTER
> REASON TO MAKE THE PORT PRIVILEGED?!!
> 
> Eliot
> 
> --
> to unsubscribe send a message to [email-masked] with the
> word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/netconf/>
> 
> 
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/netconf/>
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>

---

From: Simon Leinen <[email-masked]>
Date: Thu, 16 Mar 2006 23:54:01 +0100

McDonald, Ira writes:
> It is not possible to use NetConf (or SHOULD NOT be) without strong
> authentication - in any case, security professionals do NOT accept
> the pseudo-security of "well known ports" based on their numeric
> values.

Right, but using a <1024 port seems to be the convention for protocols
that talk with system-level entities - and a device's configuration
agent is certainly an example of one.  Therefore I think a port from
the well-known/system/privileged range is appropriate here.

I agree that "privileged" ports are a weak security mechanism.  But
then I don't understand why you are so worried about our contribution
to exhausting them.  Once the other 300 or so privileged ports will be
used up, people will simply be forced to abandon this weak security
concept (or try to reclaim old port assignments that have fallen out
of use, or open up another range of "privileged" ports).

In my personal experience, low port numbers seem to give security
admins a warmer and fuzzier feeling when you ask them to open ports in
their filters.  Therefore I think <1024 port would make NETCONF
deployment easier, if only slightly.
-- 
Simon.

---

From: "Randy Presuhn" <[email-masked]>
Date: Thu, 16 Mar 2006 15:02:39 -0800

Hi -

> From: "McDonald, Ira" <[email-masked]>
> To: "'Sharon Chisholm'" <[email-masked]>; "Netconf (E-mail)" <[email-masked]>
> Sent: Thursday, March 16, 2006 11:03 AM
> Subject: RE: Evaluation: draft-ietf-netconf-ssh-05.txt to Proposed Standar d [I06-051127-0011]
...
> Option (2) is obviously the prudent choide.

I strongly agree.

> do NOT accept the pseudo-security of "well known ports" based
...

I find this rationale far more convincing than any of the
others put forth on this thread.

Randy

---

From: Andy Bierman <[email-masked]>
Date: Thu, 16 Mar 2006 15:57:56 -0800

> others put forth on this thread.

Let's leave security out of the argument for the moment.
At first, this is what made me think we didn't really need
a number < 1024.  Picking (2) out of spite just to make
a point that (1) is not strong enough security anyway
may not be the best choice.

Does the expected use of the protocol meet the criteria
for classifying it in the privileged system space?
When I looked at the problem this way,  I changed my mind.

The current  practice with CLI, HTML, and SMI based network management
protocols is to use privileged port numbers.  Why is NETCONF different?

> Randy

Andy

---

From: "Randy Presuhn" <[email-masked]>
Date: Thu, 16 Mar 2006 21:37:15 -0800

Hi -

> From: "Andy Bierman" <[email-masked]>
> To: "Randy Presuhn" <[email-masked]>
> Cc: "Netconf (E-mail)" <[email-masked]>
> Sent: Thursday, March 16, 2006 3:57 PM
> Subject: Re: Evaluation: draft-ietf-netconf-ssh-05.txt to Proposed Standar d [I06-051127-0011]
...
...

It isn't a legacy protocol.

But if folks think that using a particular port number will
improve security, or that using a number less that 1024
will simplify implementation or improve interoperability,
I don't care enough about this to keep arguing the point.

Randy

---

From: Andy Bierman <[email-masked]>
Date: Fri, 17 Mar 2006 08:10:02 -0800

> It isn't a legacy protocol.

Try telling operators that SSH, HTTP, and SNMP are legacy protocols.
This is pretty much all that's out there.

> I don't care enough about this to keep arguing the point.

We don't think we are improving security.
It is about following current practice, 'best' or otherwise.
IMO, there is a strong pre-existing expectation that a configuration
protocol like NETCONF should be in the system port number range.

Andy

---

From: Steve Moulton <[email-masked]>
Date: Fri, 17 Mar 2006 11:34:51 -0500

> protocol like NETCONF should be in the system port number range.

As far as I can tell, the only security implication one way or the
other is whether non-netconf (i.e., other user) applications can
bind to the port, possibly preempting use by netconf (even though
the netconf service is likely to start before user applications).  
On unix-like systems, port numbers below 1024 enforce this.  
On non-unix-like systems, this argument may not hold.

If there is a difference wrt authentication, I don't see it (but my
security glasses are, at best, astigmatic).  

So, to my understanding, there are two arguments for reserving
a port below 1024:  preempting user processes, and pre-existing
expectation as noted by Andy.  It is not clear to me that
those at IANA who gatekeep such things will find these sufficiently
strong arguments.

---
Steve Moulton        SNMP Research, Inc            voice: +1 865 573 1434
Sr Software Engineer 3001 Kimberlin Heights Rd.    fax: +1 865 573 9197
moulton at snmp.com  Knoxville, TN 37920-9716 USA  http://www.snmp.com

---

From: Andy Bierman <[email-masked]>
Date: Fri, 17 Mar 2006 08:56:18 -0800

> those at IANA who gatekeep such things will find these sufficiently

Well they should -- just follow the logic:

1) It doesn't matter what the port number is
2) Port numbers <1024 are not important, and therefore not scarce
3) Use a >1024 number anyway to preserve this relatively scarce 
resource  (?)

OR

1) It doesn't matter what the port number is, except on unix implementations
2) Use a <1024 number, since their relative scarcity is irrelevant,
   and it will help unix implementations prevent hackers from easily 
spoofing
   the netconf agent.

Andy