IETF Logo Mail Archive

Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans

Tianran Zhou <zhoutianran@huawei.com> Fri, 19 May 2017 04:17 UTC

Return-Path: <zhoutianran@huawei.com>
X-Original-To: opsawg@ietfa.amsl.com
Delivered-To: opsawg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D01412EB7A; Thu, 18 May 2017 21:17:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.222
X-Spam-Level:
X-Spam-Status: No, score=-4.222 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6XW-VXNrgVmA; Thu, 18 May 2017 21:17:40 -0700 (PDT)
Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6373D129C36; Thu, 18 May 2017 21:12:13 -0700 (PDT)
Received: from 172.18.7.190 (EHLO lhreml707-cah.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id DNI55208; Fri, 19 May 2017 04:12:11 +0000 (GMT)
Received: from NKGEML411-HUB.china.huawei.com (10.98.56.70) by lhreml707-cah.china.huawei.com (10.201.108.48) with Microsoft SMTP Server (TLS) id 14.3.301.0; Fri, 19 May 2017 05:12:10 +0100
Received: from NKGEML515-MBX.china.huawei.com ([fe80::a54a:89d2:c471:ff]) by nkgeml411-hub.china.huawei.com ([10.98.56.70]) with mapi id 14.03.0235.001; Fri, 19 May 2017 12:12:06 +0800
From: Tianran Zhou <zhoutianran@huawei.com>
To: Alan DeKok <aland@deployingradius.com>, "t.petch" <ietfc@btconnect.com>
CC: Ignas Bagdonas <ibagdona@gmail.com>, IETF OOPSAWG <opsawg@ietf.org>, "draft-ietf-opsawg-tacacs@ietf.org" <draft-ietf-opsawg-tacacs@ietf.org>, "opsawg-chairs@ietf.org" <opsawg-chairs@ietf.org>
Thread-Topic: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans
Thread-Index: AQHSy08ttZSP0sW41keg1j/jrc0SIqHwlGUAgACwjQCAAF79gIADaB0AgACY5seAAIYPYIAELuD4//+FDwCAATVpUA==
Date: Fri, 19 May 2017 04:12:05 +0000
Message-ID: <BBA82579FD347748BEADC4C445EA0F21A2385014@NKGEML515-MBX.china.huawei.com>
References: <D53BBCC7.22ECC8%dcmgash@cisco.com> <61D9FC7A-6F10-44E6-8400-578C4FEE1988@deployingradius.com> <D53C62F4.22F82E%dcmgash@cisco.com> <E7D62944-46B9-4091-BF16-0AF8CA47626D@deployingradius.com> <fc8a1ff5-db6f-d463-8ff7-77ec03f1f25f@gmail.com> <006101d2cd9c$e8c0afe0$4001a8c0@gateway.2wire.net> <BBA82579FD347748BEADC4C445EA0F21A237CE44@NKGEML515-MBX.china.huawei.com> <00c501d2cff7$ca31d1a0$4001a8c0@gateway.2wire.net> <ED75808C-16B0-491E-BDA4-688BA05F747E@deployingradius.com>
In-Reply-To: <ED75808C-16B0-491E-BDA4-688BA05F747E@deployingradius.com>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.111.156.116]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-CFilter-Loop: Reflected
X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020202.591E709B.0132, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32
X-Mirapoint-Loop-Id: 1cc4deecea39d26d01528db6f007fe95
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsawg/obCVaH1xsFhZ6k6UQQg-BoCh51c>
Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status and Plans
X-BeenThere: opsawg@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OPSA Working Group Mail List <opsawg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsawg>, <mailto:opsawg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/opsawg/>
List-Post: <mailto:opsawg@ietf.org>
List-Help: <mailto:opsawg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsawg>, <mailto:opsawg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 19 May 2017 04:17:41 -0000

> -----Original Message-----
> From: Alan DeKok [mailto:aland@deployingradius.com]
> Sent: Friday, May 19, 2017 1:40 AM
> To: t.petch
> Cc: Tianran Zhou; Ignas Bagdonas; IETF OOPSAWG;
> draft-ietf-opsawg-tacacs@ietf.org; opsawg-chairs@ietf.org
> Subject: Re: [OPSAWG] draft-ietf-opsawg-tacacs-06 Contributions, Status
> and Plans
> 
> On May 18, 2017, at 12:57 PM, t.petch <ietfc@btconnect.com> wrote: of
> thought.
> >
> >
> > This I-D, as Alan has commented and Doug acknowledges, has several
> > places where the description of security is more 1997 than 2017.  If
> > we turn such parts into a clear, concise specification, we may then
> > find that we have wasted our time since the Security Directorate then
> > says that no way can that appear in an RFC, even an Informational one.
> 
>   They've approved RADIUS RFCs... by holding their nose.
> 
> > Would it be worth seeking guidance now on what is or is not likely to
> > be acceptable to a Security Directorate review?  Not a line by line
> > analysis but rather higher level guidance as to whether such things as
> > MD4, ASCII login,
> > RFC2433 as Best Practice and so on can appear.
> 
>   I've been on the Security Directorate for a while now.  While I don't claim
> to speak for everyone, I think the current approach in the draft will be
> fine.
> 
>   They may ask for some sections to be removed (i.e. servers pushing keys
> to clients). But everything else is pretty much fine.
> 

Good to know this information. Thanks.

>   The idea is that having a documented protocol, with warnings and caveats,
> is much better than an undocumented one.
>

Yes. It's what we got from the previous WG consensus.

Tianran

>   Alan DeKok.

v2.23.0 | Report a Bug | By Email