Subject: [Netconf] I-D Action: draft-ietf-netconf-access-control-05.txt

From: [email-masked]
Date: Tue, 04 Oct 2011 10:10:52 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Network Configuration Working Group of the IETF.

	Title           : Network Configuration Protocol (NETCONF) Access Control Model
	Author(s)       : Andy Bierman
                          Martin Bjorklund
	Filename        : draft-ietf-netconf-access-control-05.txt
	Pages           : 52
	Date            : 2011-10-04

   The standardization of network configuration interfaces for use with
   the NETCONF protocol requires a structured and secure operating
   environment that promotes human usability and multi-vendor
   interoperability.  There is a need for standard mechanisms to
   restrict NETCONF protocol access for particular users to a pre-
   configured subset of all available NETCONF protocol operations and
   content.  This document defines such an access control model.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-netconf-access-control-05.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-netconf-access-control-05.txt

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Wed, 05 Oct 2011 09:55:39 +0200

-------- Original Message --------
Subject: [Netconf] I-D Action: draft-ietf-netconf-access-control-05.txt
Date: Tue, 04 Oct 2011 10:10:52 -0700
From: [email-masked]
To: [email-masked]
CC: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Network 
Configuration Working Group of the IETF.

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-netconf-access-control-05.txt
_______________________________________________
Netconf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netconf

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Wed, 05 Oct 2011 13:49:47 +0200

Dear WG members,

last night a new revision of the Access Control
Model document wat posted (revision 05).
The changes (as documented) in the ID itself are
listed below.

A quick browse of the document does show that
the text has been touched quite a bit. So a good and
detailed review is important.

Please do check if all your comments have been addressed.

Send you reviews and comments no later than 21 Okt 2011.
Just letting us know that you have read the document and
can approve of it or have no objections, also that is
useful for us (WG chairs) to determine review activity
and consensus.

If this WGLC passes without too much serious issues, then
the next step will be IETF wide LC. Possibly even before
the next IETF meeting.

Changelog for rev 4 to rev 5.

	Updated Security Considerations section.	
				
	Changed term 'operator' to 'administrator'.	
				
	Used the terms "access operation" and "protocol operation"	
	consistently.	
				
	Moved some normative text from section 2 to section 3. Also made it	
	more clear that section 2 is not a requirements section, but	
	documentation of the objectives for NACM.	
				
	Renamed "nacm:secure" to "nacm:default-deny-write", and "nacm:very-	
	secure" to "nacm:default-deny-all". Explained that "nacm:default-	
	deny-write" is ignored on rpc statements.	
		
	Described that <kill-session> and <delete-config> behave as if	
	specified with "nacm:default-deny-all".

Bert and Mehmet

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Thu, 06 Oct 2011 12:12:29 +0200

The following are my comments/questions after my first
read of draft-ietf-netconf-access-control-05.txt.

The are provided with my individual/technical contributor hat on.

In general, I think this document is ready to pass to the
next stage, i.e. send it to our AD for consideration to
publish as PS RFC.

On page 13, 2nd bullet it says:

    o  If the configuration datastore or conceptual state data is
       accessed by the protocol operation, then the data node access MUST
       be authorized.  If the user is authorized to perform the requested
       access operation on the requested data, then processing continues.

So my question: is an error returned if access is NOT authorized?
Or if part of the data is authorized and not other parts. I think it
becomes clearer on the following pages, but possibly adding some text
here to explain that non-accessible data-nodes are skipped (on read
at least). Or are you meaning that "at least to one data node
access MUST be authorized" in order to continue processing. Remains
the question: will there be an an error returned if that is not the
case? Maybe the once sentence to add here could be:

    See following pages which (if any) error is returned in case
    there is no authorization.

Section 3.2, 2nd para:

    Only the standard NETCONF datastores (candidate, running, and
    startup) are controlled by the ACM.  Local or remote files or
    datastores accessed via the <url> parameter are optional to support.

"are optional to support". From a security standpoint?
I suspect that you mean to say that <url> support is an
optional capability in the NETCONF protocol, and that
if that capability is supported, that the security/access-control
to those datastores is an implementation specific method?
If so, maybe we should make that clearer.

Pure editorial:

Step 7 on page 26

         *  The rule does not have a "rule-type" defined, or the "rule-
            type" is "notification" and the "notification-name" is "*",
            equals the name of the notification.

s/equals/or equals/ I think

Section: 3.5.  Data Model Definitions

    This section defines the semantics of the conceptual data structures
    found in the data model in Section 3.5.

So that last "Section 3.5" is a self-reference?

Middle of page 38:
    NACM requires some a user name in each NACM group mapping.  An

s/some // ??

Page 48:

    permit-interface:  This rule gives the "admin" group read-write
       access to all acme <interface>. entries.  This is an example of an
       unreachable rule because the "mod-3" rule already gives the
       "admin" group full access to this data.

which "mod-3" rule? It was specified/used in revision 4 of the doc,
but not in this revision.

Bert

---

From: "Bert Wijnen (IETF)" <[email-masked]>
Date: Fri, 14 Oct 2011 09:21:44 +0200

Gentle reminder!

Please do review and post your comments/questions/support/objections
by Friday 21st of October.

We explicitly ask you to ALSO let us know if you have read and
support or agree with the document.

Bert and Mehmet

-------- Original Message --------
Subject: [Netconf] WG Last Call for draft-ietf-netconf-access-control-05.txt - runs till okt 21st 2011
Date: Wed, 05 Oct 2011 13:49:47 +0200
From: Bert Wijnen (IETF) <[email-masked]>
To: netconf <[email-masked]>

Dear WG members,

				

				

Bert and Mehmet