[nfsv4] Fwd: Stephen Farrell's No Objection on draft-ietf-nfsv4-federated-fs-protocol-14: (with COMMENT)

[Chuck Lever <[e-mail]>]

Begin forwarded message:

> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> 
> - section 6: *use* of TLS is RECOMMENDED which is fine, but
> you don't say that implementation of TLS is a MUST.  I think
> it'd be good to be explicit about that. (LDAP is a bit oddly
> structured, maybe in a way to leave wiggle room to say you
> conform here even though you don't support LDAP/TLS.)

Here is the first paragraph of section 6 of the NSDB document:

>    Both the NFSv4 and LDAPv3 protocols provide security mechanisms.
>    When used in conjunction with the federated filesystem protocols
>    described in this document, the use of these mechanisms is
>    RECOMMENDED.  Specifically, the use of RPCSEC_GSS [RFC2203], which is
>    built on the GSS-API [RFC2743], is RECOMMENDED on all NFS connections
>    between a file-access client and fileserver.  The "Security
>    Considerations" sections of the NFSv4.0 [3530bis] and NFSv4.1
>    [RFC5661] specifications contain special considerations for the
>    handling of GETATTR operations for the fs_locations and
>    fs_locations_info attributes.  For all LDAP connections established
>    by the federated filesystem protocols, the use of TLS [RFC5246], as
>    described in [RFC4513], is RECOMMENDED.


Looking back at the private e-mail thread at the end of July 2012 that culminates here:

  http://www.ietf.org/mail-archive/web/nfsv4/current/msg11248.html

I don't see that we excluded on purpose a requirement to implement (but not use) TLS for NSDB connections.  Should we add a requirement to implement?

--
Chuck Lever
chuck[dot]lever[at]oracle[dot]com