Re: [Netconf] [Technical Errata Reported] RFC6242 (5305)

[Ignas Bagdonas <[e-mail]>]

Hi there,

This paragraph taken out as stand-alone seems to have somewhat different 
meaning than if read together with the previous one in the document. If 
NETCONF is used over default port, it is explicitly required to be 
controlled by security policy, but there is no such requirement when 
used over non-default port, and the quoted paragraph mentions precisely 
this non-default port case. Therefore it seems that the text in the 
document is correct.

The other aspect is the operational practice of security policies for 
network elements - generally it should be deny all allow what is needed, 
but that is not what the document is focusing on.

Any opinions?

Thank you,

Ignas



On 26/03/2018 07:19, RFC Errata System wrote:
> The following errata report has been submitted for RFC6242,
> "Using the NETCONF Protocol over Secure Shell (SSH)".
>
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata/eid5305
>
> --------------------------------------
> Type: Technical
> Reported by: HengyingFan <[e-mail]>
>
> Section: 6
>
> Original Text
> -------------
>     This document also recommends that SSH servers be configurable to
>     allow access to the "netconf" SSH subsystem over other ports.  Use of
>     that configuration option without corresponding changes to firewall
>     or network device configuration may unintentionally result in the
>     ability for nodes outside of the firewall or other administrative
>     boundaries to gain access to the "netconf" SSH subsystem.
>
>
> Corrected Text
> --------------
>     This document also recommends that SSH servers be configurable to
>     allow access to the "netconf" SSH subsystem over other ports.  Use of
>     that configuration option without corresponding changes to firewall
>     or network device configuration may unintentionally result in the
>     inability for nodes outside of the firewall or other administrative
>     boundaries to gain access to the "netconf" SSH subsystem.
>
>
> Notes
> -----
> ability -> inability
>
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party
> can log in to change the status and edit the report, if necessary.
>
> --------------------------------------
> RFC6242 (draft-ietf-netconf-rfc4742bis-08)
> --------------------------------------
> Title               : Using the NETCONF Protocol over Secure Shell (SSH)
> Publication Date    : June 2011
> Author(s)           : M. Wasserman
> Category            : PROPOSED STANDARD
> Source              : Network Configuration
> Area                : Operations and Management
> Stream              : IETF
> Verifying Party     : IESG