Re: [OPSAWG] [Netconf] guidance on draft-kwatsen-reverse-ssh

[Andy Bierman <[e-mail]>]

On 07/19/2011 03:24 AM, Juergen Schoenwaelder wrote:
> On Tue, Jul 19, 2011 at 10:22:38AM +0200, t.petch wrote:
>
>> My recollection is somewhat different to Juergen's.
>>
>> Call home was requested by Eliot Lear but did not get much support in isms WG.
>>
>> Sam Hartman, as AD, ruled it out of scope since the WG already had a lot to do,
>> the charter was to add security to SNMPv3 and not to introduce functions that
>> SNMPv3 did not have (like call home).  You will find this in the archives in
>> August 2005, particularly around August 18th.
>
> Yes, ISMS was never chartered to work on call home. However, we had to
> address the question how a notification originator sends notifications
> to a notification receiver via SSH. And this is very similar and this
> is the discussion I have been referring to in my previous email.
>

Here is the original charter text from Eliot Lear:

    http://www.ietf.org/mail-archive/web/ietf/current/msg38521.html

Here are David Harrington's slides on why not ISMS:

    http://www.ietf.org/proceedings/64/slides/callhome-5.pdf

Here are the Callhome BoF minutes:

    http://www.ietf.org/proceedings/64/callhome.html

My recollection of the conclusion was that the problem space was not big enough,
and an SSH-specific solution was inappropriate.  A more general approach should
be investigated.

So almost 6 years have passed, and NETCONF vendors still want a call-home solution for SSH.
IMO, Ken's proposal should be published (assuming the security experts approve).
NETCONF notifications are rarely used.  The main reason given is that the client
connection maintenance is not worth the resources and coding effort.  I think
call-home for SSH could make NETCONF more deployable.


> /js
>

Andy