Re: [Netconf] Ben Campbell's No Objection on draft-ietf-netconf-call-home-11: (with COMMENT)

[Kent Watsen <[e-mail]>]

>>>> I'm curious why people felt it necessary to reverse the usual TLS or 
>>>> SSH
>>>> client and server roles. Did the working group consider having the
>>>> NETCONF/RESTCONF server act as the TLS or SSH client? If so, can the
>>> As Juergen noted, this allows all existing authentication to 
>>> continue working.  Also, since SSH is not a symmetric protocol, 
>>> it’s actually important for the client to be the SSH-client so it 
>>> can open/close SSH channels (e.g., to start the “netconf” 
>>> subsystem).
>> Ben, do you feel we need to mention it in the draft?

Actually, the draft already has this:

  Having consistency in both the secure transport layer (SSH, TLS) and
  application layer (NETCONF, RESTCONF) roles conveniently enables
  deployed network management infrastructure to support call home also.
  For instance, existing certificate chains and user authentication
  mechanisms are unaffected by call home.

Good enough?



>I am happy with Stephen's suggestion (in a different branch of the 
>thread) to send some questions to the TLS wg and openssh list. I will be 
>fine with whatever results from that.

Yes, we’ll see how that plays out.

Thanks,
Kent