Re: [Netconf] reverse ssh recommendation

[Joe Touch <[e-mail]>]

On 6/21/2013 12:02 PM, Kent Watsen wrote:
>
>> Ports are a scarce resource; they should not be consumed for convenience.
>
>
> I've been wondering about why tcpmux (port #1, rfc 1078) hasn't been more
> popular, after all, no one believes port-based firewalls matter anymore
> and, with it, only one port would ever need to be opened...

See http://www.isi.edu/touch/pubs/draft-touch-tcp-portnames-00.txt, esp. 
Section 2.4

We are actually implementing the TCP port option described in this doc 
(which isn't TCPMUX), but that doesn't address this problem at all - nor 
does TCPMUX. Either way, the question is whether this is one service or 
two different services.

> With the potential desire to reverse the TLS protocol as well, I was
> thinking that we could ourselves use tcpmux with service names
> "NETCONF_REVERSE_SSH" and "NETCONF_REVERSE_TLS".  But no other protocol
> does this and there is no IANA-maintained assignment for TCPMUX services,
> so maybe the port-scarcity issue isn't quite so dire?

It isn't dire, but that's *because* they require substantial review, and 
many requests for "yet another port for the same service for 
convenience" are declined.

The modern equivalent of TCPMUX, FWIW, would be Service Names in the DNS 
service records, for which there is an active IANA registry and a BOF 
coming up (dnssdext).

> Note for anyone who wants to take the survey, please assume that in
> question #2, using TCPMUX is the same as using "an IANA-assigned port".

Yes, if you mean DNS SRV records.

No, if you mean TCPMUX. It effectively doesn't exist.

Joe