Re: [secdir] secdir review of draft-ietf-v6ops-v6-aaaa-whitelisting-implications-03

["Livingood, Jason" <[e-mail]>]

Thanks for your review, Russ. I'll be posting an updated –04 revision soon, once I make it through all the bits of other feedback in my queue. Some specific responses are inline below.

Thank you!
JL

On 5/2/11 3:58 PM, "Russ Mundy" <[e-mail]<mailto:[e-mail]>> wrote:


I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments.

I found the document to be well written as well as providing sound technical descriptions of the topic of DNS Whitelisting.

>From a security review perspective, I do have a suggestion for section 10 Security Considerations.  The section infers (at least to me) that there is something different or unique for configuring DNS Whitelist configuration protection from other configuration settings for name servers.  Unless I've misunderstood how servers actually implement whitelisting, it uses the same configuration mechanisms and files as any other name server ACL or many other name server configuration settings - _all_ the configuration settings for a name server should be protected so that only authorized individuals can change them.  Modifying the wording to say something to the effect of "Just as all configuration settings for name servers should be protected by appropriate procedures and systems ..."

[JL] Great suggestion — and that has been added to the upcoming update.



Russ Mundy