Subject: Re: [Netconf] draft-ietf-netconf-reverse-ssh: MUST only be used for a NETCONF server

From: Kent Watsen <[email-masked]>
Date: Tue, 27 May 2014 21:30:06 +0000

Just reviewing list mail while putting the finishing touches on the netconf-server-model draft and noticed this one.

Unfortunately, this change did NOT make it into the -06 draft.   I just made this change to my working copy, as the first change that will go into -07, which I'll hold off posting for now...

Thanks,
Kent

From: Kent Watsen <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, March 4, 2014 at 4:01 PM
To: Benoit Claise <[email-masked]<mailto:[email-masked]>>, NetConf <[email-masked]<mailto:[email-masked]>>
Cc: Stephen Hanna <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Netconf] draft-ietf-netconf-reverse-ssh: MUST only be used for a NETCONF server

CC-ing Steve, who wrote the Applicability Statement.

Kent

From: Benoit Claise <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, March 4, 2014 5:27 AM
To: NetConf <[email-masked]<mailto:[email-masked]>>
Subject: [Netconf] draft-ietf-netconf-reverse-ssh: MUST only be used for a NETCONF server

Dear all,

Yesterday, Andy asked how this MUST could be enforced in draft-ietf-netconf-reverse-ssh
   However, these techniques MUST only be used for a NETCONF server to
    initiate a connection to a NETCONF client, as described in this
    document.
The way I understood this statement: the security experts wanted us to restrict the scope to only NETCONF. Fine.
However, that "MUST" can't be enforced, at least with RFC 2119 keyword.
This should be changed to "must".

We should obviously validate this with the security experts.

Regards, Benoit