Re: [netmod] I-D Action: draft-ietf-netmod-system-mgmt-11.txt

["Yi Yang (yiya)" <[e-mail]>]

Please see my comments inline with [yi]:

On 2/6/14 10:25 AM, "Juergen Schoenwaelder"
<[e-mail]> wrote:

>On Thu, Feb 06, 2014 at 03:05:24PM +0100, Martin Bjorklund wrote:
>> Juergen Schoenwaelder <[e-mail]> wrote:
>> > On Thu, Feb 06, 2014 at 12:59:14PM +0100, Martin Bjorklund wrote:
>> > > Juergen Schoenwaelder <[e-mail]> wrote:
>> > > > On Wed, Feb 05, 2014 at 07:05:30PM +0000, Yi Yang (yiya) wrote:
>> > > > > I have a quick question on authentication method.
>> > > > > 
>> > > > > If the system supports SSH public key authentication only, but
>>not local
>> > > > > user password, how user-authentication-order should be set?
>> > > >  
>> > > > I think this is fair question to ask. Martin and Andy, are we
>>missing
>> > > > an identity for this case?
>> > > 
>> > > The local-users feature handles SSH keys as well, see 3.5.1.  As
>> > > explained in 3.5.1, ssh public key authentication is requested by
>>the
>> > > client, so the authentication-order on the server doesn't really
>> > > apply.
>> > > 
>> > 
>> > Martin,
>> > 
>> > we are talking about the case where you disable password and
>> > key-interactive authentication on the server side. This is actually
>> > how I run the machines I am reponsible for (so I can sleep well
>> > despite all the SSH login scanners out there).
>> 
>> Ok, but it doesn't make much sense to control this with
>> user-authentication-order.  The reason for this is that it is unclear
>> what this means:
>> 
>>   user-authentication-order: radius, ssh-key
>> 
>> First radius, then ssh-key?  It doesn't make much sense.
>> 
>> Actually, this can be achieved today if you set
>> user-authentication-order to the empty list.
>
>OK, fine with me (after reading the text again).
>
>I guess the confusion comes from 'user-authentication-order' which is
>really 'user-password-authentication-order' (and no, I do not suggest
>this longish name).

[yi]: How about "password-authentication-order" or simply "password-order"?

>But perhaps this can be clarified? Eg. by stating explicitly:
>
>    An empty user-authentication-order list still allows
>    authentication of users using mechanisms that do not involve a
>    password.

[yi]: Only when public-key based approach is supported. In other words, if
public-key based approach is not supported, an empty
"*-authentication-order" list should not be allowed.

Yi


>
>/js
>
>-- 
>Juergen Schoenwaelder           Jacobs University Bremen gGmbH
>Phone: [phone]         Campus Ring 1, 28759 Bremen, Germany
>Fax:   [phone]         <http://www.jacobs-university.de/>