IETF Logo Mail Archive

Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans

Alan DeKok <aland@deployingradius.com> Thu, 18 May 2017 17:46 UTC

Return-Path: <aland@deployingradius.com>
X-Original-To: opsawg@ietfa.amsl.com
Delivered-To: opsawg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1CC6F12EAF7; Thu, 18 May 2017 10:46:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.001
X-Spam-Level:
X-Spam-Status: No, score=-0.001 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IRe0y8G-LCaK; Thu, 18 May 2017 10:46:15 -0700 (PDT)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 90BAC128896; Thu, 18 May 2017 10:40:29 -0700 (PDT)
Received: from [192.168.120.42] (23-233-24-114.cpe.pppoe.ca [23.233.24.114]) by mail.networkradius.com (Postfix) with ESMTPSA id 060F81205; Thu, 18 May 2017 17:40:27 +0000 (UTC)
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
Content-Type: text/plain; charset="us-ascii"
From: Alan DeKok <aland@deployingradius.com>
X-Priority: 3
In-Reply-To: <00c501d2cff7$ca31d1a0$4001a8c0@gateway.2wire.net>
Date: Thu, 18 May 2017 13:40:26 -0400
Cc: Tianran Zhou <zhoutianran@huawei.com>, Ignas Bagdonas <ibagdona@gmail.com>, IETF OOPSAWG <opsawg@ietf.org>, draft-ietf-opsawg-tacacs@ietf.org, opsawg-chairs@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <ED75808C-16B0-491E-BDA4-688BA05F747E@deployingradius.com>
References: <D53BBCC7.22ECC8%dcmgash@cisco.com> <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <D53C62F4.22F82E%dcmgash@cisco.com> <E7D62944-46B9-4091-BF16-0AF8CA47626D@deployingradius.com> <fc8a1ff5-db6f-d463-8ff7-77ec03f1f25f@gmail.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <BBA82579FD347748BEADC4C445EA0F21A237CE44@NKGEML515-MBX.china.huawei.com> <00c501d2cff7$ca31d1a0$4001a8c0@gateway.2wire.net>
To: "t.petch" <ietfc@btconnect.com>
X-Mailer: Apple Mail (2.3124)
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsawg/T_FPibDsX-mN9xsK4bjFPSgZJy4>
Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans
X-BeenThere: opsawg@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OPSA Working Group Mail List <opsawg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsawg>, <mailto:opsawg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/opsawg/>
List-Post: <mailto:opsawg@ietf.org>
List-Help: <mailto:opsawg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsawg>, <mailto:opsawg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 18 May 2017 17:46:18 -0000

On May 18, 2017, at 12:57 PM, t.petch <ietfc@btconnect.com> wrote: of thought.
> 
> 
> This I-D, as Alan has commented and Doug acknowledges, has several
> places where the description of security is more 1997 than 2017.  If we
> turn such parts into a clear, concise specification, we may then find
> that we have wasted our time since the Security Directorate then says
> that no
> way can that appear in an RFC, even an Informational one.

  They've approved RADIUS RFCs... by holding their nose.

> Would it be worth seeking guidance now on what is or is not likely to be
> acceptable to a Security Directorate review?  Not a line by line
> analysis but rather
> higher level guidance as to whether such things as MD4, ASCII login,
> RFC2433 as Best Practice and so on can appear.

  I've been on the Security Directorate for a while now.  While I don't claim to speak for everyone, I think the current approach in the draft will be fine.

  They may ask for some sections to be removed (i.e. servers pushing keys to clients). But everything else is pretty much fine.

  The idea is that having a documented protocol, with warnings and caveats, is much better than an undocumented one.

  Alan DeKok.

v2.23.0 | Report a Bug | By Email