Re: [Netconf] [Technical Errata Reported] RFC6242 (5305)

[Margaret Cullen <[e-mail]>]

I agree that the text in the original document is correct.  If you have a firewall configured to protect your devices by not allowing outside devices to access NETCONF over SSH on the default port, and you configure one of your devices to use NETCONF over SSH on a non-default port, that device may not be protected by the firewall and may be subject to attack from outside attackers.

Margaret


> On Mar 26, 2018, at 12:07 PM, Ignas Bagdonas <[e-mail]> wrote:
> 
> Hi there,
> 
> This paragraph taken out as stand-alone seems to have somewhat different meaning than if read together with the previous one in the document. If NETCONF is used over default port, it is explicitly required to be controlled by security policy, but there is no such requirement when used over non-default port, and the quoted paragraph mentions precisely this non-default port case. Therefore it seems that the text in the document is correct.
> 
> The other aspect is the operational practice of security policies for network elements - generally it should be deny all allow what is needed, but that is not what the document is focusing on.
> 
> Any opinions?
> 
> Thank you,
> 
> Ignas
> 
> 
> 
> On 26/03/2018 07:19, RFC Errata System wrote:
>> The following errata report has been submitted for RFC6242,
>> "Using the NETCONF Protocol over Secure Shell (SSH)".
>> 
>> --------------------------------------
>> You may review the report below and at:
>> http://www.rfc-editor.org/errata/eid5305
>> 
>> --------------------------------------
>> Type: Technical
>> Reported by: HengyingFan <[e-mail]>
>> 
>> Section: 6
>> 
>> Original Text
>> -------------
>>   This document also recommends that SSH servers be configurable to
>>   allow access to the "netconf" SSH subsystem over other ports.  Use of
>>   that configuration option without corresponding changes to firewall
>>   or network device configuration may unintentionally result in the
>>   ability for nodes outside of the firewall or other administrative
>>   boundaries to gain access to the "netconf" SSH subsystem.
>> 
>> 
>> Corrected Text
>> --------------
>>   This document also recommends that SSH servers be configurable to
>>   allow access to the "netconf" SSH subsystem over other ports.  Use of
>>   that configuration option without corresponding changes to firewall
>>   or network device configuration may unintentionally result in the
>>   inability for nodes outside of the firewall or other administrative
>>   boundaries to gain access to the "netconf" SSH subsystem.
>> 
>> 
>> Notes
>> -----
>> ability -> inability
>> 
>> Instructions:
>> -------------
>> This erratum is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party
>> can log in to change the status and edit the report, if necessary.
>> 
>> --------------------------------------
>> RFC6242 (draft-ietf-netconf-rfc4742bis-08)
>> --------------------------------------
>> Title               : Using the NETCONF Protocol over Secure Shell (SSH)
>> Publication Date    : June 2011
>> Author(s)           : M. Wasserman
>> Category            : PROPOSED STANDARD
>> Source              : Network Configuration
>> Area                : Operations and Management
>> Stream              : IETF
>> Verifying Party     : IESG
>