IETF Logo Mail Archive

Re: [netmod] security considerations boilerplate updates to cover RESTCONF

Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de> Thu, 16 March 2017 07:56 UTC

Return-Path: <j.schoenwaelder@jacobs-university.de>
X-Original-To: netmod@ietfa.amsl.com
Delivered-To: netmod@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E925B126DC2; Thu, 16 Mar 2017 00:56:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.201
X-Spam-Level:
X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o22ttWoj6uHq; Thu, 16 Mar 2017 00:56:55 -0700 (PDT)
Received: from atlas3.jacobs-university.de (atlas3.jacobs-university.de [212.201.44.18]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1564D126C23; Thu, 16 Mar 2017 00:56:55 -0700 (PDT)
Received: from localhost (demetrius5.irc-it.jacobs-university.de [10.70.0.222]) by atlas3.jacobs-university.de (Postfix) with ESMTP id D893426; Thu, 16 Mar 2017 08:56:53 +0100 (CET)
X-Virus-Scanned: amavisd-new at jacobs-university.de
Received: from atlas3.jacobs-university.de ([10.70.0.205]) by localhost (demetrius5.jacobs-university.de [10.70.0.222]) (amavisd-new, port 10030) with ESMTP id EJ6EYHsqYEv0; Thu, 16 Mar 2017 08:56:52 +0100 (CET)
Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "hermes.jacobs-university.de", Issuer "Jacobs University CA - G01" (verified OK)) by atlas3.jacobs-university.de (Postfix) with ESMTPS; Thu, 16 Mar 2017 08:56:53 +0100 (CET)
Received: from localhost (demetrius3.jacobs-university.de [212.201.44.48]) by hermes.jacobs-university.de (Postfix) with ESMTP id 887A320035; Thu, 16 Mar 2017 08:56:53 +0100 (CET)
X-Virus-Scanned: amavisd-new at jacobs-university.de
Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius3.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id keVyAxTXy7Aj; Thu, 16 Mar 2017 08:56:53 +0100 (CET)
Received: from elstar.local (elstar.jacobs.jacobs-university.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 12CA720033; Thu, 16 Mar 2017 08:56:53 +0100 (CET)
Received: by elstar.local (Postfix, from userid 501) id 5D3BC3EBED4D; Thu, 16 Mar 2017 08:56:57 +0100 (CET)
Date: Thu, 16 Mar 2017 08:56:57 +0100
From: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
To: Benoit Claise <bclaise@cisco.com>
Cc: Kent Watsen <kwatsen@juniper.net>, "netmod@ietf.org" <netmod@ietf.org>, "sec-ads@ietf.org" <sec-ads@ietf.org>
Message-ID: <20170316075657.GF59114@elstar.local>
Reply-To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
Mail-Followup-To: Benoit Claise <bclaise@cisco.com>, Kent Watsen <kwatsen@juniper.net>, "netmod@ietf.org" <netmod@ietf.org>, "sec-ads@ietf.org" <sec-ads@ietf.org>
References: <20170313212537.GB53972@elstar.local> <7de29e11-f045-b0a1-808f-38044f6f7352@cisco.com> <8E887FD1-9849-4A05-A43F-CF675056A7B5@juniper.net> <1fdc07f6-0434-a490-024d-af039877ae33@cisco.com> <20170316072757.GD59114@elstar.local> <0138111b-6c95-0edc-23c4-2797312bb51a@cisco.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <0138111b-6c95-0edc-23c4-2797312bb51a@cisco.com>
User-Agent: Mutt/1.6.0 (2016-04-01)
Archived-At: <https://mailarchive.ietf.org/arch/msg/netmod/N_W_fEFLnH4mbiFotKzIvCBiSt8>
Subject: Re: [netmod] security considerations boilerplate updates to cover RESTCONF
X-BeenThere: netmod@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: NETMOD WG list <netmod.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netmod>, <mailto:netmod-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netmod/>
List-Post: <mailto:netmod@ietf.org>
List-Help: <mailto:netmod-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netmod>, <mailto:netmod-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Mar 2017 07:56:57 -0000

On Thu, Mar 16, 2017 at 08:37:39AM +0100, Benoit Claise wrote:
> Latest proposal:
> 
>     The YANG module defined in this document is designed to be accessed
>     via network management protocols such as NETCONF [RFC6241] or
>     RESTCONF [RFC8040]. The lowest NETCONF layer is the secure transport
> layer,
>     and mandatory-to-implement secure transport is Secure Shell (SSH)
> [RFC6242],
>     while the lowest RESTCONF layer is HTTP, and the mandatory-to-implement
> secure
>     transport is Transport Layer Security (TLS) [RFC5246].

Picking wording from Section 12 of RFC 8040 to replace your second
sentence I get this:

    The YANG module defined in this document is designed to be
    accessed via network management protocols such as NETCONF
    [RFC6241] or RESTCONF [RFC8040]. The lowest NETCONF layer is the
    secure transport layer, and the mandatory-to-implement secure
    transport is Secure Shell (SSH) [RFC6242]. The lowest RESTCONF
    layer is HTTPS, and the mandatory-to-implement secure transport is
    TLS [RFC5246].

    The NETCONF access control model [RFC6536] provides the means to
    restrict access for particular NETCONF or RESTCONF users to a
    pre-configured subset of all available NETCONF or RESTCONF
    protocol operations and content.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

v2.23.0 | Report a Bug | By Email