Re: [secdir] SecDir review of draft-ietf-opsawg-syslog-msg-mib-04

["Romascanu, Dan (Dan)" <[e-mail]>]

Hi Magnus,

Thank you for the review. 

I will let the authors respond on the rest, but I have one comment about the following: 

 

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On 
> Behalf Of Magnus Nystr?m

> 
> - (Editorial) In the Security Considerations section, there 
> is a paragraph
>    recommending against deployment of earlier versions of SNMP. For
>    clarity and correctness ("NOT RECOMMENDED" is not a key 
> word) I suggest
>    this paragraph is rewritten to (several changes in the below):


Actually RFC 2119 says: 

  4. SHOULD NOT   This phrase, or the phrase "NOT RECOMMENDED" mean that
   there may exist valid reasons in particular circumstances when the
   particular behavior is acceptable or even useful, but the full
   implications should be understood and the case carefully weighed
   before implementing any behavior described with this label.

NOT RECOMMENDED is thus accepted as a synonim to SHOULD NOT if the syntax of the phrase demands it. 

The current boilerplate for Security Considerations sections described at http://www.ops.ietf.org/mib-security.html was carefully crafted by the Security AD's and OPS AD's a few years ago, and is used since in all RFCs that define MIB modules. I would not recommend using a different wording, unless there is a good reason and the current AD's agree on the change. 

Thanks and Regards,

Dan


> 
>     Further, SNMP versions prior to SNMPv3 SHOULD NOT be deployed.
>     Instead, SNMPv3 with enabled cryptographic security 
> SHOULD be deployed.
>     It is then a customer/operator responsibility to ensure 
> that the SNMP
>     entity giving access to an instance of this MIB module is properly
>     configured to give access to the objects only to those principals
>     (users) that indeed have legitimate rights to GET or SET
>     (change/create/delete) them.
> 
> -- Magnus
>