Re: [netconf] Latest ietf-netconf-server draft and related modules

Thanks for the input. So based on this my idea was simply to allow to configure this common use-case directly. But yes, it would result in configuring the password twice although once for the "password" authentication, the second time for the "keyboard-interactive" method. I consider that not to be a problem and believe the distinction between the used methods being important on its own.

Regards,
Michal

On Monday, April 26, 2021 19:21 CEST, Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de> wrote: 

> On Mon, Apr 26, 2021 at 05:06:48PM +0000, Kent Watsen wrote:
> > 
> > * The sshd_config manage says:
> > 
> >     AuthenticationMethods
> >              Specifies the authentication methods that must be successfully completed for a user to be granted access.  This
> >              option must be followed by one or more lists of comma-separated authentication method names, or by the single
> >              string any to indicate the default behaviour of accepting any single authentication method.  If the default is
> >              overridden, then successful authentication requires completion of every method in at least one of these lists.
> > 
> >              For example, "publickey,password publickey,keyboard-interactive" would require the user to complete public key
> >              authentication, followed by either password or keyboard interactive authentication.  Only methods that are next in
> >              one or more lists are offered at each stage, so for this example it would not be possible to attempt password or
> >              keyboard-interactive authentication before public key.
> > 
> > 
> > As yet, with the current model, I don’t see a direct correlation to “AuthenticationMethods”, unless you think “keyboard-interactive” is it, but that doesn’t follow from the manpage snippet above.
> >
> 
> SSH iterates over the authentication methods that both peers
> offer. The 'keyboard-interactive' method (RFC 4256) hooks into PAM,
> for many setups this results by default to password authentication,
> but depending on the PAM module selected, 'keyboard-interactive' can
> carry more complex challenge response dialogues.
> 
>    [...] With the generic
>    method defined here, clients will not require code changes to support
>    new authentication mechanisms, and if a separate authentication layer
>    is used, such as [PAM], then the server may not need any code changes
>    either.
> 
> >From a YANG perspective, keyboard-interactive is of course challenging
> to model since you end up modeling something as flexible as PAM...
> 
> /js
> 
> -- 
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
> Fax:   +49 421 200 3103         <https://www.jacobs-university.de/>
> 
> _______________________________________________
> netconf mailing list
> netconf@ietf.org
> https://www.ietf.org/mailman/listinfo/netconf