Re: [netmod] I-D Action: draft-ietf-netmod-system-mgmt-15.txt

[Kent Watsen <[e-mail]>]

Hi Juergen,



>>The netmod-system-management defines config for User Authentication and
>> says that it does so for SSH because that is NETCONF's mandatory to
>> implement transport.  Meanwhile we have netconf-server-model, which is
>> suppose to be just about configuring the NETCONF server, and yet it has
>> user-auth config for TLS (not SSH) in it.  This inconsistency is the
>>issue.
>
>I do not think this is a fair summary. Both, SSH and TLS call home
>need parameters configured on the NC server side but also on the NC
>client side, (e.g. the SSH user and its credentials to call home).
>Where will this stuff go?


Are you asking where NC client information is configured? - as in which
yang model it can go into?

We don't define yang models for NC clients, so what do you mean?


FWIW, on the client side, there are two call-home preconditions:

1. The client needs a trust anchor to verify the device with.  This could
be, for instance, a vendor's well-known CA certificate that the NMS
installed a priori.  Or it could be that the NMS has the device's TLS
server-cert or SSH host-key.   Either way, how the NMS obtains this
information is unspecified in both the 5539bis and reverse-ssh drafts.

2. The client needs to know what user credentials to use when logging into
a device.  As always, the device must be configured with a local user
account.  How the NMS knows the account information configured on the
device is also unspecified in both the 5539bis and reverse-ssh drafts.




>>So, what are our options?
>> 
>> 1. Go forward with current inconsistency
>> 
>> 2. Only modify draft-ietf-netconf-server-model, but move TLS user-auth
>>out
>>    of ietf-server-model into a separate model that augments ietf-system
>> 
>> 3. Similar to #2, but move the ietf-system augmentation back to 5539bis
>> 
>> 4. Similar to #2, but move the TLS-auth directly (no augmentation) into
>>    the ietf-system model defined in draft-ietf-netmod-system-mgmt
>> 
>> 5. Move all user-auth config from draft-ietf-netmod-system-mgmt into
>>    draft-ietf-netconf-server-model
>> 
>> 6. Move all user-auth config from both draft-ietf-netmod-system-mgmt
>>    and draft-ietf-netconf-server-model into yet another draft (for
>>    instance, draft-ietf-netmod-user-auth?)
>> 
>> 7. Anything else?
>
>As NETMOD WG co-chair, I want to publish draft-ietf-netmod-system-mgmt.
>Building "perfect" modules means we will never finish. Once again,
>modules can be revised and augmented if needed.


So I take it you're ok with options 1, 2, or 3.   Andy said 2 was OK and
no one else responded.   I think that 2 is better than 1 and tied with 3.
So it looks like 2 has the lead, as weak as it is.


Thanks,
Kent