Re: [Netconf] username from X.503 was Re: Summary of and AIs from the NETCONF Session in IETF #91

t.petch <ietfc@btconnect.com> Wed, 10 December 2014 15:24 UTC

Message-ID: <046401d0148d$3bd05e40$4001a8c0@gateway.2wire.net>
From: "t.petch" <ietfc@btconnect.com>
To: Kent Watsen <kwatsen@juniper.net>, Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
References: <E4DE949E6CE3E34993A2FF8AE79131F819562134@DEMUMBX005.nsn-intra.net> <04e401cfff2d$74e7e740$4001a8c0@gateway.2wire.net> <20141208133201.GB41570@elstar.local> <D0ABB36A.8BED1%kwatsen@juniper.net>
Date: Wed, 10 Dec 2014 15:23:09 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/netconf/IzYwIy6S0AySRdy8H5zK4sPKKyY
Cc: netconf <netconf@ietf.org>
Subject: Re: [Netconf] username from X.503 was Re: Summary of and AIs from the NETCONF Session in IETF #91
Precedence: list

----- Original Message -----
From: "Kent Watsen" <kwatsen@juniper.net>
To: "Juergen Schoenwaelder" <j.schoenwaelder@jacobs-university.de>; "t.
petch" <ietfc@btconnect.com>
Cc: "netconf" <netconf@ietf.org>
Sent: Tuesday, December 09, 2014 2:12 AM
>>
>> > Describe algorithm for extracting a user name out of the X509
>> attributes
>> >    - loud humm in favor
>> >
>>
>> A clarification - does this mean that this algorithm goes in
>> netconf-server?
>
>The idea (as far as I understood it) is that NC over TLS provides a
>high-level description of the algorithm. The NC server configuration
>document will define the YANG objects to configure this.

I didn't articulate clearly enough at the mic about the "what" and
"how", but Juergen agreed so I'm sure not that he's a mindreader  ;)

Anyway, in reflecting on this, I realized what I should've said
is that it should be whatever is needed so that 5539bis has an
Informative (not Normative) reference to server-model.   Again,
this is the necessary because alternate configuration models can
exist, thus it doesn't make sense to me for 5539bis to say that
it can *only* be configured by just the server-model.

My hope is that 5539bis will assert that client-certs are required
and specify that servers must be configurable to know how to extract
a username using the various options (specified, subAltName, DNS,
etc.).   Another option is for 5539bis to have a Normative reference
onto draft-ietf-netmod-snmp-cfg, section 4.1, though that may be too
convoluted for some.

<tp>
Yes, and no.  SNMP over TLS requires the client to present a certificate
which must be present in the server's table, and that is it.  No DNS,
AltName etc.  I would want a good reason to move on from that (perhaps
customers have done so).  But that is in RFC6353 and not in snmp-cfg,
which is different in some details.

Also, I don't know where we got to with SSH and certificates, whether or
not that is likely to appear - part of my logic is that putting it in
server-model covers all protocols for the server (but not for the
client) while putting it in 5539bis can cover both client and server
(but only for TLS).

Tom Petch

Kent

[Netconf] Summary of and AIs from the NETCONF Ses… Ersue, Mehmet (NSN - DE/Munich)
[Netconf] 5539bis was Re: Summary of and AIs from… t.petch
[Netconf] username from X.503 was Re: Summary of … t.petch
Re: [Netconf] 5539bis was Re: Summary of and AIs … Juergen Schoenwaelder
Re: [Netconf] username from X.503 was Re: Summary… Juergen Schoenwaelder
Re: [Netconf] username from X.503 was Re: Summary… Kent Watsen
Re: [Netconf] username from X.503 was Re: Summary… t.petch
Re: [Netconf] username from X.503 was Re: Summary… Juergen Schoenwaelder