Re: [OPSAWG] I-D Action: draft-ietf-opsawg-tacacs-tls13-03.txt

[Alan DeKok <[e-mail]>]

On Jul 10, 2023, at 10:09 PM, Peter Marrinon <peter.marrinon=[e-mail]> wrote:
> This feedback is based on my own review and some comments from people in my team who will be implementing this in our internal TACACS+ system. Our issues are relatively minor; we generally believe we could take most of this standard and implement it as intended. 

  I have some related comments.  Rather than start a new thread, I'll reply here.
>  
> ISSUES THAT CAUSED CONFUSION
>  
> 3.2 Based on some questions from a developer in my team, it may be beneficial to explicitly state that earlier versions of TLS MUST NOT be supported. I think the text implies it but explicitly stating it may stop someone also adding support for earlier versions. 

  Agreed.

> 3.2.1 Cipher Requirements: "The cipher suites offered or accepted SHOULD be configurable so that operators can adapt." It is slightly unclear what the operators are adapting. Is this meant to be "The cipher suites offered or accepted SHOULD be configurable by operators" or is there a subtlety I'm missing?

  The implementation should expose enough TLS configuration that the administrator can change the cipher list if necessary.  For example:  https://github.com/FreeRADIUS/freeradius-server/blob/release_3_2_3/raddb/mods-available/eap#L407

  That just takes configuration:

	cipher_list = "..."

  and hands the string over to OpenSSL, which does it's magic.  This lets the admin use "DEFAULT" in most cases.  But if the admin needs to change that, it's simple to do so.

> 3.3 TLS identification: There does not appear to be any network location based validation methods in section 5.2 of RFC5425. Is it meant to be a reference to the using a wildcard with a domain?

  I would agree that implementations should support IP-layer filtering by network.  The TACACS+ server may be accessible on a management network, but perhaps only part of that network contains edge devices which will connect via TACACS+.

  As a result, it is useful to have a configuration which can say "allow network FOO, forbid network BAR".  This would be in addition to any TLS layer filtering.

  Alan DeKok.