Re: [Netconf] [Technical Errata Reported] RFC6242 (5305)

[Robert Wilton <[e-mail]>]

I also think that the existing RFC text looks right.

My reading of the text is that it is suggesting that allowing netconf 
access over other port numbers is a good idea, but care needs to be 
taken to ensure that this doesn't result in unauthorized access to the 
netconf/ssh subsystem.

Thanks,
Rob


On 26/03/2018 17:07, Ignas Bagdonas wrote:
> Hi there,
>
> This paragraph taken out as stand-alone seems to have somewhat 
> different meaning than if read together with the previous one in the 
> document. If NETCONF is used over default port, it is explicitly 
> required to be controlled by security policy, but there is no such 
> requirement when used over non-default port, and the quoted paragraph 
> mentions precisely this non-default port case. Therefore it seems that 
> the text in the document is correct.
>
> The other aspect is the operational practice of security policies for 
> network elements - generally it should be deny all allow what is 
> needed, but that is not what the document is focusing on.
>
> Any opinions?
>
> Thank you,
>
> Ignas
>
>
>
> On 26/03/2018 07:19, RFC Errata System wrote:
>> The following errata report has been submitted for RFC6242,
>> "Using the NETCONF Protocol over Secure Shell (SSH)".
>>
>> --------------------------------------
>> You may review the report below and at:
>> http://www.rfc-editor.org/errata/eid5305
>>
>> --------------------------------------
>> Type: Technical
>> Reported by: HengyingFan <[e-mail]>
>>
>> Section: 6
>>
>> Original Text
>> -------------
>>     This document also recommends that SSH servers be configurable to
>>     allow access to the "netconf" SSH subsystem over other ports.  
>> Use of
>>     that configuration option without corresponding changes to firewall
>>     or network device configuration may unintentionally result in the
>>     ability for nodes outside of the firewall or other administrative
>>     boundaries to gain access to the "netconf" SSH subsystem.
>>
>>
>> Corrected Text
>> --------------
>>     This document also recommends that SSH servers be configurable to
>>     allow access to the "netconf" SSH subsystem over other ports.  
>> Use of
>>     that configuration option without corresponding changes to firewall
>>     or network device configuration may unintentionally result in the
>>     inability for nodes outside of the firewall or other administrative
>>     boundaries to gain access to the "netconf" SSH subsystem.
>>
>>
>> Notes
>> -----
>> ability -> inability
>>
>> Instructions:
>> -------------
>> This erratum is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party
>> can log in to change the status and edit the report, if necessary.
>>
>> --------------------------------------
>> RFC6242 (draft-ietf-netconf-rfc4742bis-08)
>> --------------------------------------
>> Title               : Using the NETCONF Protocol over Secure Shell (SSH)
>> Publication Date    : June 2011
>> Author(s)           : M. Wasserman
>> Category            : PROPOSED STANDARD
>> Source              : Network Configuration
>> Area                : Operations and Management
>> Stream              : IETF
>> Verifying Party     : IESG
>
> _______________________________________________
> Netconf mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/netconf
> .
>