Subject: [Netconf] FW: David Harrington's Discuss on draft-ietf-netconf-access-control-06:(with DISCUSS and COMMENT)

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 1 Dec 2011 17:08:00 +0100

Please address the issues raised by David in his DISCUSS. 

Thanks and Regards,

Dan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of David Harrington
Sent: Thursday, December 01, 2011 6:06 PM
To: The IESG
Cc: [email-masked]; [email-masked]
Subject: David Harrington's Discuss on draft-ietf-netconf-access-control-06:(with DISCUSS and COMMENT)

David Harrington has entered the following ballot position for
draft-ietf-netconf-access-control-06: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I plan to ballot YES once a few concerns are addressed.

1) in 3.4.3, a server must not include sensitive information. How does one determine what is sensitive? Should the server check the sensitivity marker in the mib module? without clear definition of sensitive, the "MUST NOT" doesn't make much sense, since the implementation cannot implement such a rule in an interoperable manner

2) in 3.4.5, the securituy considerations section should discuss the potential for misuse of adding groups from the transport. This effectively overrides the constraints pre-configured by an admin in the nacm. Should there be an enable/disable object that allows an admin to say "do NOT consider the groups specified by transport"? (ISMS had a long discussion about whether RADIUS or the pre-configured VACM rules should be dominant.)

3) section 3.4.6 says nacm configuration for notifications is out of scope of this document. Is there a document that does address this? 

4) SNMPv3's VACM describes how to apply rules to notifications. If nacm for notifications is content-ignorant, then the security considerations should advise admins to be aware that any user authorized to receive notifications has access to any data that might be included in the notification. This could cause inadvertently disclose to a user information that should be subject to privacy rules (and potentially privacy laws), or other sensitive data that should not be sharable across users. 

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

1) in section 3.5, the one sentence refers to section 3.5. I don't think the sentence adds anything, even if you meant to point to the YANG module in 3.5.2.