Re: [netmod] I-D Action: draft-ietf-netmod-system-mgmt-15.txt

[Juergen Schoenwaelder <[e-mail]>]

On Thu, May 01, 2014 at 04:18:33AM +0000, Kent Watsen wrote:
> 
> 
> The problem is that if it doesn¹t go into draft-ietf-netmod-system-mgmt,
> then the alternative solutions (see bottom) may compound the problem.  Now
> is the time for us to at least look at it and agree what makes sense.  I¹m
> all for us doing the right thing, whatever it might be, but we haven¹t
> even discussed what that is yet.
> 

Since there are no concrete edits people agree on at this point in
time, I do not plan to move draft-ietf-netmod-system-mgmt back form
the IESG into the WG to work on it a couple of more weeks and then to
restart the whole procedure.

> The netmod-system-management defines config for User Authentication and
> says that it does so for SSH because that is NETCONF¹s mandatory to
> implement transport.  Meanwhile we have netconf-server-model, which is
> suppose to be just about configuring the NETCONF server, and yet it has
> user-auth config for TLS (not SSH) in it.  This inconsistency is the issue.

I do not think this is a fair summary. Both, SSH and TLS call home
need parameters configured on the NC server side but also on the NC
client side, (e.g. the SSH user and its credentials to call home).
Where will this stuff go?

Sure, we can move the cert-maps and psk-maps to some other module, I
am not sure though it really helps solving a concrete problem. These
are at the end objects to implement on the NC server, whether they are
defined as part of draft-ietf-netmod-system-mgmt, netconf-server-model
or some other module. And the maps are rather NETCONF over TLS
specific.  The SSH authentication objects may also be used outside
NETCONF, e.g. to configure plain old access to the system's CLI.
 
> So, what are our options?
> 
> 1. Go forward with current inconsistency
> 
> 2. Only modify draft-ietf-netconf-server-model, but move TLS user-auth out
>    of ietf-server-model into a separate model that augments ietf-system
> 
> 3. Similar to #2, but move the ietf-system augmentation back to 5539bis
> 
> 4. Similar to #2, but move the TLS-auth directly (no augmentation) into
>    the ietf-system model defined in draft-ietf-netmod-system-mgmt
> 
> 5. Move all user-auth config from draft-ietf-netmod-system-mgmt into
>    draft-ietf-netconf-server-model
> 
> 6. Move all user-auth config from both draft-ietf-netmod-system-mgmt
>    and draft-ietf-netconf-server-model into yet another draft (for
>    instance, draft-ietf-netmod-user-auth?)
> 
> 7. Anything else?

As NETMOD WG co-chair, I want to publish draft-ietf-netmod-system-mgmt.
Building "perfect" modules means we will never finish. Once again,
modules can be revised and augmented if needed.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1, 28759 Bremen, Germany
Fax:   [phone]         <http://www.jacobs-university.de/>