Re: [Netconf] [Technical Errata Reported] RFC6242 (5305)

[Mahesh Jethanandani <[e-mail]>]

My recommendation is to reject the errata. The text as it exists, is correct in saying that if non-default port is used, an the firewall rules are not updated, that it may result in the ability to access the NETCONF SSH subsystem, which may not be covered by firewall or other administrative boundaries.

> On Mar 26, 2018, at 9:07 AM, Ignas Bagdonas <[e-mail]> wrote:
> 
> Hi there,
> 
> This paragraph taken out as stand-alone seems to have somewhat different meaning than if read together with the previous one in the document. If NETCONF is used over default port, it is explicitly required to be controlled by security policy, but there is no such requirement when used over non-default port, and the quoted paragraph mentions precisely this non-default port case. Therefore it seems that the text in the document is correct.
> 
> The other aspect is the operational practice of security policies for network elements - generally it should be deny all allow what is needed, but that is not what the document is focusing on.
> 
> Any opinions?
> 
> Thank you,
> 
> Ignas
> 
> 
> 
> On 26/03/2018 07:19, RFC Errata System wrote:
>> The following errata report has been submitted for RFC6242,
>> "Using the NETCONF Protocol over Secure Shell (SSH)".
>> 
>> --------------------------------------
>> You may review the report below and at:
>> http://www.rfc-editor.org/errata/eid5305
>> 
>> --------------------------------------
>> Type: Technical
>> Reported by: HengyingFan <[e-mail]>
>> 
>> Section: 6
>> 
>> Original Text
>> -------------
>>    This document also recommends that SSH servers be configurable to
>>    allow access to the "netconf" SSH subsystem over other ports.  Use of
>>    that configuration option without corresponding changes to firewall
>>    or network device configuration may unintentionally result in the
>>    ability for nodes outside of the firewall or other administrative
>>    boundaries to gain access to the "netconf" SSH subsystem.
>> 
>> 
>> Corrected Text
>> --------------
>>    This document also recommends that SSH servers be configurable to
>>    allow access to the "netconf" SSH subsystem over other ports.  Use of
>>    that configuration option without corresponding changes to firewall
>>    or network device configuration may unintentionally result in the
>>    inability for nodes outside of the firewall or other administrative
>>    boundaries to gain access to the "netconf" SSH subsystem.
>> 
>> 
>> Notes
>> -----
>> ability -> inability
>> 
>> Instructions:
>> -------------
>> This erratum is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party
>> can log in to change the status and edit the report, if necessary.
>> 
>> --------------------------------------
>> RFC6242 (draft-ietf-netconf-rfc4742bis-08)
>> --------------------------------------
>> Title               : Using the NETCONF Protocol over Secure Shell (SSH)
>> Publication Date    : June 2011
>> Author(s)           : M. Wasserman
>> Category            : PROPOSED STANDARD
>> Source              : Network Configuration
>> Area                : Operations and Management
>> Stream              : IETF
>> Verifying Party     : IESG
> 

Mahesh Jethanandani
[e-mail]