Subject: [Syslog] FW: DISCUSS: draft-ietf-syslog-transport-tls

From: "David Harrington" <[email-masked]>
Date: Wed, 13 Aug 2008 09:37:14 -0400

Hi,

There is a question of whether we need a system port or just a
registered port.

As co-chair, I think the WG should be involved in this discussion.
The document is scheduled to be discussed by the IESG on Thursday, so
quick responses are important.

Would a registered port be adequate for syslog/tls, or is there a
compelling reason why it MUST be a system port?

David Harrington
[email-masked]
[email-masked]
[email-masked]

-----Original Message-----
From: Lars Eggert [mailto:[email-masked]] 
Sent: Wednesday, August 13, 2008 2:53 AM
To: ext Joseph Salowey (jsalowey)
Subject: Re: DISCUSS: draft-ietf-syslog-transport-tls 

Hi,

On 2008-8-13, at 9:05, ext Joseph Salowey (jsalowey) wrote:
> This was discussed in the working group.  The following is a list of
> reasons that were given in support of a system port (somewhat
> paraphrased):
>
> 1. We expect syslog-tls to become widespread adopted (if we would
not
> expect this, we could simply drop the effort - this is why the WG
has
> been rechartered).

Sure, but widely adopted != needs a port < 1024. Lots of widely- 
adopted protocols use a registered port in the 1024-49151 range.

> 2. Syslog traditionally has been assigned a dedicated port in the  
> system
> range (514 and 601).
>
> 3. Syslog was considered important enough to assign a dedicated port

> in
> the past (601 with RFC 3195) - the same should apply to this effort

We've been continuing to run out of system port space since those  
ports were allocated. If there is no technical reason for a low port  
number, I'd like to push back a bit on historic consistency as an  
argument.

> 4. The syslog daemon is considered an essential system service and  
> part
> of many important operating systems

True, but see my answer to 1.

> 5. Operators expect a dedicated port for an essential protocol
>
> 6. A dedicated port greatly reduces the likelihood of syslogd
startup
> errors due to port being used by another process
>
> 7. A dedicated port greatly reduces ambiguity, which is especially
> important as a number of SOHO deceives/applications is expected to
> implement the protocol. For low-knowledge, "nearly plug-and-play"
> scenarios, senders and receivers need a universal understanding of
the
> port number to use.

As for 5-7, syslog will get a dedicated port, but in the 1024-49151  
range instead of one < 1024.

> 8. (derived argument) Combining argument #1 and #4, there will be a
> very large number of systems utilizing that port, thus justifying
> assigning a scarce resource.
>
> I think these arguments are convincing, but I am unsure as to the
> criteria for assigning a system port.

draft-ietf-tsvwg-iana-ports has some text on this.

Basically, the difference between the well-known and registered port  
ranges has been diminishing to the point where it has become  
irrelevant. For example, on a few operating systems, only root can  
bind to well known ports. This is not a security feature, quite the  
opposite - most system daemons only become root to bind to the port  
and then drop privileges to run as a regular user and sometimes even  
in a sandbox, as to not become an attack vector. If they used a  
registered port, they'd not even need to jump through these hoops.

Al that said, I agree that this change in IANA policy hasn't been  
widely communicated and the corresponding document hasn't gotten IETF

consensus yet. If the WG and the rest of the IETF thinks that we  
shouldn't strictly apply it for this reason at this time, I can live  
with that and will clear the DISCUSS on the call Thursday. (There are

only around 200 system ports left, however, so at some point we do  
need to start raising the bar.)

Lars

_______________________________________________
Syslog mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/syslog

---

From: Eliot Lear <[email-masked]>
Date: Wed, 13 Aug 2008 15:51:40 +0200

Hi Dave,
> compelling reason why it MUST be a system port?

The system port mechanism is largely an artifact of a different age, 
which would today be based on a flawed assumption that the other ports 
somehow don't need protection from local processes.  Whether they do or 
not is strictly an implementation matter and not really within this 
organization's purview.  In other words, there's probably a compelling 
reason that the system port distinction be dropped entirely, and hence 
no need or desire for its use in this specific case.

Eliot

---

From: "Rainer Gerhards" <[email-masked]>
Date: Wed, 13 Aug 2008 16:03:02 +0200

You may cast it as vote for "registered port is adequate" but... what is
" compelling reason why it MUST be a system port?" What is this for
other protocols? Why, for example, must http run over port 80 and not
some other port? IMHO it would work equally well if any other port were
used...

Rainer

> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of David Harrington
> Sent: Wednesday, August 13, 2008 3:37 PM
> To: [email-masked]
> Subject: [Syslog] FW: DISCUSS: draft-ietf-syslog-transport-tls
> 
> Hi,
>

---

From: Chris Lonvick <[email-masked]>
Date: Wed, 13 Aug 2008 11:00:17 -0700 (PDT)

Hi Folks,

We have two people who have said that we don't need a system port.  I'd 
like to have an answer back to the IESG later today (Wednesday) so they 
can move forward with it tomorrow (Thursday telechat).  If we don't hear 
anything else back we'll assume that's the consensus of the WG.

Many thanks,
Chris

---

From: Jon Callas <[email-masked]>
Date: Wed, 13 Aug 2008 12:08:55 -0700

I agree with Eliot.

The idea of system ports is a quaint artifact of a bygone era.

In the days of timesharing, when you'd have 100 lusers on your box,  
you didn't want one of the darlings to bind to port 25 (e.g.).

These days, however, it causes as many problems as it might solve. A  
box tends to have one user, or it's a server with a collection of  
cooperating processes. So if a user-level process wants to bind to  
port 25, it has to have root privs when it would not have to  
ordinarily. Other systems, like a web server, have hoops to jump  
through to de-root themselves.

So no, we don't need a system port. Getting one is as likely to cause  
problems as cure them. And the very concept should go away.

	Jon

---

From: Balazs Scheidler <[email-masked]>
Date: Thu, 14 Aug 2008 09:31:59 +0200

> anything else back we'll assume that's the consensus of the WG.

I agree too. Having a registered port is enough. logservers are usually
dedicated boxes anyway, so the chances of a collision is low. Also, the
logserver process starts early in the boot process, so clients running
on the same box will most probably find the port already taken.

PS: any chance the port allocation can happen in a few weeks? we're
about to release a syslog-ng version that supports syslog-protocol and I
would like to use the final port right from the start instead of having
to change it later. 

-- 
Bazsi