Re: [netmod] I-D Action: draft-ietf-netmod-system-mgmt-11.txt

[Juergen Schoenwaelder <[e-mail]>]

On Thu, Feb 06, 2014 at 03:05:24PM +0100, Martin Bjorklund wrote:
> Juergen Schoenwaelder <[e-mail]> wrote:
> > On Thu, Feb 06, 2014 at 12:59:14PM +0100, Martin Bjorklund wrote:
> > > Juergen Schoenwaelder <[e-mail]> wrote:
> > > > On Wed, Feb 05, 2014 at 07:05:30PM +0000, Yi Yang (yiya) wrote:
> > > > > I have a quick question on authentication method.
> > > > > 
> > > > > If the system supports SSH public key authentication only, but not local
> > > > > user password, how user-authentication-order should be set?
> > > >  
> > > > I think this is fair question to ask. Martin and Andy, are we missing
> > > > an identity for this case?
> > > 
> > > The local-users feature handles SSH keys as well, see 3.5.1.  As
> > > explained in 3.5.1, ssh public key authentication is requested by the
> > > client, so the authentication-order on the server doesn't really
> > > apply.
> > > 
> > 
> > Martin,
> > 
> > we are talking about the case where you disable password and
> > key-interactive authentication on the server side. This is actually
> > how I run the machines I am reponsible for (so I can sleep well
> > despite all the SSH login scanners out there).
> 
> Ok, but it doesn't make much sense to control this with
> user-authentication-order.  The reason for this is that it is unclear
> what this means:
> 
>   user-authentication-order: radius, ssh-key
> 
> First radius, then ssh-key?  It doesn't make much sense.
> 
> Actually, this can be achieved today if you set
> user-authentication-order to the empty list.

OK, fine with me (after reading the text again).

I guess the confusion comes from 'user-authentication-order' which is
really 'user-password-authentication-order' (and no, I do not suggest
this longish name). 

But perhaps this can be clarified? Eg. by stating explicitly:

    An empty user-authentication-order list still allows
    authentication of users using mechanisms that do not involve a
    password.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1, 28759 Bremen, Germany
Fax:   [phone]         <http://www.jacobs-university.de/>