Subject: [Syslog] Re: I-D ACTION:draft-ietf-syslog-transport-udp-05.txt

From: Glenn Mansfield Keeni <[email-masked]>
Date: Mon, 07 Nov 2005 16:20:59 +0900

Folks,
     A few minor comments on draft-ietf-syslog-transport-udp-05

a. Page 10.1
   the text says
       "This transport does not provide for strong sender authentication".
   That sort of seems to imply that "weak sender authentication" is provided
   for. Is that the intent ?
   To me it appears that no authentication is provided for.

The remaining comments are editorial in nature:

b. I would prefer the format of the document to be more hierarchically
   structured. Specifically group Sections 3-8 into a single section.
   That section defines the syslog-udp-transport.

c. page 5 section 8
        s/The Note/Note/

Glenn

[email-masked] wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Security Issues in Network Event Logging Working Group of the IETF.
> 
> 	Title		: Transmission of syslog messages over UDP
> 	Author(s)	: A. Okmianski
> 	Filename	: draft-ietf-syslog-transport-udp-05.txt
> 	Pages		: 10
> 	Date		: 2005-7-15
> 	
> This document describes the transport for syslog messages over UDP/
>    IPv4 or UDP/IPv6.  The syslog protocol layered architecture provides
>    for support of any number of transport mappings.  However, for
>    interoperability purposes, syslog protocol implementors are required
>    to support this transport protocol.
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-syslog-transport-udp-05.txt
> 
> To remove yourself from the I-D Announcement list, send a message to 
> [email-masked] with the word unsubscribe in the body of the message.  
> You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
> to change your subscription settings.
> 
> 
> Internet-Drafts are also available by anonymous FTP. Login with the username
> "anonymous" and a password of your e-mail address. After logging in,
> type "cd internet-drafts" and then
> 	"get draft-ietf-syslog-transport-udp-05.txt".
> 
> A list of Internet-Drafts directories can be found in
> http://www.ietf.org/shadow.html 
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> 
> 
> Internet-Drafts can also be obtained by e-mail.
> 
> Send a message to:
> 	[email-masked].
> In the body type:
> 	"FILE /internet-drafts/draft-ietf-syslog-transport-udp-05.txt".
> 	
> NOTE:	The mail server at ietf.org can return the document in
> 	MIME-encoded form by using the "mpack" utility.  To use this
> 	feature, insert the command "ENCODING mime" before the "FILE"
> 	command.  To decode the response(s), you will need "munpack" or
> 	a MIME-compliant mail reader.  Different MIME-compliant mail readers
> 	exhibit different behavior, especially when dealing with
> 	"multipart" MIME messages (i.e. documents which have been split
> 	up into multiple messages), so check your local documentation on
> 	how to manipulate these messages.
> 		
> 		
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/i-d-announce

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "Anton Okmianski \(aokmians\)" <[email-masked]>
Date: Tue, 8 Nov 2005 21:44:37 -0500

Glenn: 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Glenn 
> Mansfield Keeni
> Sent: Monday, November 07, 2005 2:21 AM
> To: [email-masked]
> Subject: [Syslog] Re: I-D 
> ACTION:draft-ietf-syslog-transport-udp-05.txt
> 
> 
> Folks,

It was the intent.  The source IP is a "soft" authentication.  It identifies the sender.  Not to be confused with originator of the message on which we say this:

"The source IP address of the UDP datagrams SHOULD NOT be interpreted
   as the identifier for the host that originated the syslog message.
   The entity sending the syslog message may be merely a relay.  The
   syslog message itself contains the identifier of the originator of
   the message."

I can change this to "no authentication" if you still feel it is misleading. 
 
>    That section defines the syslog-udp-transport.

Good point -- done.

>         s/The Note/Note/

Thanks!
Anton

> > You can also visit 
> https://www1.ietf.org/mailman/listinfo/I-D-announce