[netconf] Roman Danyliw's Discuss on draft-ietf-netconf-ssh-client-server-38: (with DISCUSS and COMMENT)

[Roman Danyliw via Datatracker <[e-mail]>]

Roman Danyliw has entered the following ballot position for
draft-ietf-netconf-ssh-client-server-38: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-netconf-ssh-client-server/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I struggle to understand when it is assumed that the security considerations of
the imported modules apply, and when they will be surfaced as issues in the
module that is using them.  With that confusion in mind:

** Section 5.7.  The ietf-ssh-server module is described as having no readable
data nodes that are sensitive.  Consider the example in Section 4.2.  Wouldn’t
enumerating the list of users for which there is a client-authentication
configuration be sensitive?


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

** Section 5.1, 5.2, 5.3 and 5.4?
   The protocol-accessible read-only node for the algorithms supported
   by a server is mildly sensitive, but not to the extent that special
   NACM annotations are needed to prevent read-access to regular
   authenticated administrators.

What is meant by “mildly sensitive” to call it out?

** Section 5.5.  Does this section need a disclaimer that there are groupings
that importing modules need to fully consider in their own Security
Considerations?  Same as in draft-ietf-netconf-tcp-client-server?

** Appendix A.  Please provide an informative reference to Python for this
non-normative (?) section.