Subject: Some strange text in our charter - do we have consensus?

From: "Bert Wijnen - IETF" <[email-masked]>
Date: Tue, 15 Jan 2008 23:10:45 +0100

[explicitly bcc:-ed Bill Fenner. I am not sure if he is still on the
 mailing list, Bill can you let me know?]

The current WG charter has this text:

 - The Bill Fenner problem: Address real or perceived issue that "giving
   SSH for NETCONF gives full SSH access to the box"

It is listed as a non-goal/non-work-item of the current charter.
So we can just leave it as is. 

At the other hand, at the IETF69 meeting we did not have a lot of 
"operator" feedback on this.

Discussing it with the one of the previous WG chairs (Simon),
we got this explanation from Simon:

> 
> This seems to come from a discussion at the NEE bof at IETF 69
> (http://www3.ietf.org/proceedings/07jul/minutes/nee.txt):
> 
>     [...]
>     Bill Fenner: possible gap, about authentication and authorization.
>     Operators are fine with SNMP read access, but ssh access for
>     NETCONF?  Not sure. Perception is that NETCONF ssh access gives
>     full access to the box.
>   
>     Sharon Chisholm: Exactly what is this perception?
>   
>     Bert Wijnen: Completely in conflict with NETCONF requirements!
>   
>     Bill Fenner: Different operators have different concerns...
>   
>     David Partain: what should the WG do?
>   
>     Bill Fenner: TLS would help.  Thinks we may need an authentication
>     mechanism just for NETCONF.  SSH sounds like you can login to the
>     device which is scary.
>     [...]
> 
> Maybe Bill thought (or "thought that operators would think", since
> this is about perception) that NETCONF-over-SSH was linked with a
> normal SSH server providing access to the full CLI.  That is not the
> intent: NETCONF over SSH is specified to be served on a separate TCP
> port by default, and as a special SSH subsystem called "netconf".
> 
> Well, the operators I know all permit SSH (or even TELNET) access to
> their boxes for configuration, so why wouldn't they permit
> NETCONF-over-SSH? Anyway.  So that's why we're doing TLS!
> 
> Best regards,
> -- 
> Simon.
> 

It would be good if NetConf participants (specifically operators) could
chime in what they think about this "perceived problem".

Bert

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>

---

From: Balazs Lengyel <[email-masked]>
Date: Wed, 16 Jan 2008 10:21:26 +0100

Hello Bert,
I think there should be a statement in the NETCONF over SSH RFC, Security considerations 
chapter dealing with the Bill Fenner problem.

"Users should take care that allowing NETCONF over SSH should not open up other unwanted access 
possibilities e.g. console access to the node or access to other subsystems. This can be 
realized by using a dedicated SSH server for NETCONF, or using user accounts with CLI access 
disabled; however the exact method is up to the NETCONF server implementation."

It is another question whether we want to open the RFC in order to add this? If we anyway open 
it to update it for Notifications, maybe this should go in as well.

Balazs

-- 
Balazs Lengyel                       Ericsson Hungary Ltd.
TSP System Manager
ECN: 831 7320                        Fax: +36 1 4377792
Tel: +36-1-437-7320     email: [email-masked]