Re: [netmod] I-D Action: draft-ietf-netmod-syslog-model-19.txt

[Kent Watsen <[e-mail]>]

> IMHO, if this module is supposed to be useful in practice, without
> requiring immediately proprietary augmentations, UDP needs to be
> supported.  RFC 5424 also states that implementations SHOULD
> support a UDP transport per RFC 5426.  

Agreed.


> Whether TCP support should be included is debatable because not a
> standard transport.  Perhaps it should not, however given that it
> has already been specified, I don't think it hurts to have it as
> a feature/option for implementations that require it.  

Given the IESG statement (copied below) and the HISTORIC downref, I
think that this would be a hard sell.  But, if it turns out that
most vendors support RFC 6587, then a case could be made for it.

Kent


> -----Original Message-----
> From: netmod [mailto:[e-mail]] On Behalf Of Alex
> Campbell
> Sent: Tuesday, January 16, 2018 1:46 PM
> To: Benoit Claise <[e-mail]>; Kent Watsen
> <[e-mail]>; [e-mail]
> Subject: Re: [netmod] I-D Action: draft-ietf-netmod-syslog-model-19.txt
> 
> By the same reasoning surely UDP should not be available either, because it
> also doesn't provide security.
> ________________________________________
> From: netmod <[e-mail]> on behalf of Benoit Claise
> <[e-mail]>
> Sent: Wednesday, 17 January 2018 6:23 a.m.
> To: Kent Watsen; [e-mail]
> Subject: Re: [netmod] I-D Action: draft-ietf-netmod-syslog-model-19.txt
> 
> Hi,
> >
> >    ** Downref: Normative reference to an Historic RFC: RFC 6587
> >
> > Kent: hmmm, what's going on here?  This YANG module is providing an
> ability to configure the "tcp" transport, even though the IESG made that
> ability historic in 2012 (see IESG Note below).  Searching online, it looks like
> Cisco supports this, but Juniper does not.  What about other vendors, is it
> widely supported?  Was this discussed in the WG?  Answering my own
> question, searching my local mailbox, I don't see this ever being discussed
> before, other than Martin questioning if it was a good idea in Mar 2016 (no
> response).  Please start a thread on the list to get WG opinion if it's okay for
> the draft to proceed as is or not.  Here's the IESG Note from RFC 6587:
> >
> >     IESG Note
> >
> >     The IESG does not recommend implementing or deploying syslog over
> >     plain tcp, which is described in this document, because it lacks the
> >     ability to enable strong security [RFC3365].
> >
> >     Implementation of the TLS transport [RFC5425] is recommended so that
> >     appropriate security features are available to operators who want to
> >     deploy secure syslog.  Similarly, those security features can be
> >     turned off for those who do not want them.
> >
> >
> >
> Well, I believe it's clear plain TCP should not be in the YANG module.
> 
> Regards, Benoit
>