Re: [netconf] Latest ietf-netconf-server draft and related modules

[Juergen Schoenwaelder <[e-mail]>]

On Mon, Apr 26, 2021 at 05:06:48PM +0000, Kent Watsen wrote:
> 
> * The sshd_config manage says:
> 
>     AuthenticationMethods
>              Specifies the authentication methods that must be successfully completed for a user to be granted access.  This
>              option must be followed by one or more lists of comma-separated authentication method names, or by the single
>              string any to indicate the default behaviour of accepting any single authentication method.  If the default is
>              overridden, then successful authentication requires completion of every method in at least one of these lists.
> 
>              For example, "publickey,password publickey,keyboard-interactive" would require the user to complete public key
>              authentication, followed by either password or keyboard interactive authentication.  Only methods that are next in
>              one or more lists are offered at each stage, so for this example it would not be possible to attempt password or
>              keyboard-interactive authentication before public key.
> 
> 
> As yet, with the current model, I don’t see a direct correlation to “AuthenticationMethods”, unless you think “keyboard-interactive” is it, but that doesn’t follow from the manpage snippet above.
>

SSH iterates over the authentication methods that both peers
offer. The 'keyboard-interactive' method (RFC 4256) hooks into PAM,
for many setups this results by default to password authentication,
but depending on the PAM module selected, 'keyboard-interactive' can
carry more complex challenge response dialogues.

   [...] With the generic
   method defined here, clients will not require code changes to support
   new authentication mechanisms, and if a separate authentication layer
   is used, such as [PAM], then the server may not need any code changes
   either.

>From a YANG perspective, keyboard-interactive is of course challenging
to model since you end up modeling something as flexible as PAM...

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <https://www.jacobs-university.de/>