Re: [nfsv4] Kathleen Moriarty's Discuss on draft-ietf-nfsv4-flex-files-15: (with DISCUSS)

> On Jan 24, 2018, at 3:47 PM, Spencer Dawkins at IETF <spencerdawkins.ietf@gmail.com> wrote:
> 
> Kathleen and EKR,
> 
> On Jan 24, 2018 16:25, "Tom Haynes" <loghyr@gmail.com <mailto:loghyr@gmail.com>> wrote:
> I purposely did not update the document to avoid confusion during this process.
> 
> There was an unanswered question in my last reply, namely concerning the use
> of SHOULD versus MUST in the 3rd sentence below:
> 
>    It is RECOMMENDED to implement common access control methods at the
>    storage device filesystem to allow only the metadata server root
>    (super user) access to the storage device, and to set the owner of
>    all directories holding data files to the root user.  This approach
>    provides a practical model to enforce access control and fence off
>    cooperative clients, but it can not protect against malicious
>    clients; hence it provides a level of security equivalent to
>    AUTH_SYS.  Communications between the metadata server and file server
>    SHOULD be secure from eavesdroppers and man-in-the-middle protocol
>    tampering.  The security measure could be due to physical security
>    (e.g., the servers are co-located in a physically secure area), from
>    encrypted communications, or some other technique.
> 
> 
> > On Jan 24, 2018, at 8:42 AM, Kathleen Moriarty <Kathleen.Moriarty.ietf@gmail.com <mailto:Kathleen.Moriarty.ietf@gmail.com>> wrote:
> >
> > Kathleen Moriarty has entered the following ballot position for
> > draft-ietf-nfsv4-flex-files-15: Discuss
> >
> > When responding, please keep the subject line intact and reply to all
> > email addresses included in the To and CC lines. (Feel free to cut this
> > introductory paragraph, however.)
> >
> >
> > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html <https://www.ietf.org/iesg/statement/discuss-criteria.html>
> > for more information about IESG DISCUSS and COMMENT positions.
> >
> >
> > The document, along with other ballot positions, can be found here:
> > https://datatracker.ietf.org/doc/draft-ietf-nfsv4-flex-files/ <https://datatracker.ietf.org/doc/draft-ietf-nfsv4-flex-files/>
> >
> >
> >
> > ----------------------------------------------------------------------
> > DISCUSS:
> > ----------------------------------------------------------------------
> >
> > Thanks for your response to the SecDir review.  I see the proposed changes have
> > not been integrated yet.  This discuss will be resolved when the SecDir review
> > changes have been included.
> >
> 
> I purposely did not update the document to avoid confusion during this process.
> 
> There was an unanswered question in my last reply, namely concerning the use
> of SHOULD versus MUST in the 3rd sentence below:
> 
>    It is RECOMMENDED to implement common access control methods at the
>    storage device filesystem to allow only the metadata server root
>    (super user) access to the storage device, and to set the owner of
>    all directories holding data files to the root user.  This approach
>    provides a practical model to enforce access control and fence off
>    cooperative clients, but it can not protect against malicious
>    clients; hence it provides a level of security equivalent to
>    AUTH_SYS.  Communications between the metadata server and file server
>    SHOULD be secure from eavesdroppers and man-in-the-middle protocol
>    tampering.  The security measure could be due to physical security
>    (e.g., the servers are co-located in a physically secure area), from
>    encrypted communications, or some other technique.
> 
> Do you folks have any thoughts about whether "secure from eavesdroppers" ought to be SHOULD or MUST?
> 
> IIUC, Thomas was reluctant to specify MUST ... and since we're saying that co-location in a secure area is one of the options, I'm not sure why this would be either SHOULD or MUST in the first place. 
> 

Customer has two data centers and wants to do client-side mirroring between them.

I would certainly hope they have some form of secure link between the sites, but
I can’t force that on them!

> Conformance test cases for that requirement would be a riot ... :-)
> 

Yes, but I hate lying ahead of time.:-(

> Spencer
> 
> > https://mailarchive.ietf.org/arch/msg/secdir/HKdT2KjnWJFmzEPxlGcNH0OnUDg <https://mailarchive.ietf.org/arch/msg/secdir/HKdT2KjnWJFmzEPxlGcNH0OnUDg>
> >
> >
> >
> >
> > _______________________________________________
> > nfsv4 mailing list
> > nfsv4@ietf.org <mailto:nfsv4@ietf.org>
> > https://www.ietf.org/mailman/listinfo/nfsv4 <https://www.ietf.org/mailman/listinfo/nfsv4>
> 
> _______________________________________________
> nfsv4 mailing list
> nfsv4@ietf.org <mailto:nfsv4@ietf.org>
> https://www.ietf.org/mailman/listinfo/nfsv4 <https://www.ietf.org/mailman/listinfo/nfsv4>