Re: [nfsv4] Kathleen Moriarty's No Objection on draft-ietf-nfsv4-scsi-layout-08: (with COMMENT)

[Christoph Hellwig <[e-mail]>]

Hi Kathleen,

sorry for the delay, somehow this comments slipped through the cracks
and Spencer had to remind me of it.

On Mon, Aug 29, 2016 at 11:57:14AM -0700, Kathleen Moriarty wrote:
> For the security considerations, it would be good to include a few
> examples of the security provided by iSCSI, like encryption via IPsec
> (tunnel and transport mode - IMO opinion this RFC makes it difficult to
> set this up in an interoperable way, but that's not the responsibility of
> this draft), authentication, etc.  RFC7143 is such a large document, just
> a pointer isn't as helpful here in comparison to the no security example.
>  This is just at the comment level since the pointer is technically
> sufficient, but sets one up for a lot of reading.

I don't think it makes much sense to address the iSCSI security
issues in this document, and here is why:

As far as the pNFS SCSI layout is concerned setting up the actual
SCSI transport is completely out of scope, and that's intentional because
there are so many different SCSI transports and implementations, and
I don't want to get into details for any of them except mentioning a few.

But maybe as a compromise I can add references to RFC3723 and RFC7146
which seems to be the IETF canonical answer on how to secure iSCSI?