IETF Logo Mail Archive

Re: [Syslog] Some revised text for syslog TLS

"tom.petch" <cfinss@dial.pipex.com> Tue, 27 May 2008 17:22 UTC

Return-Path: <syslog-bounces@ietf.org>
X-Original-To: syslog-archive@megatron.ietf.org
Delivered-To: ietfarch-syslog-archive@core3.amsl.com
Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EF4973A6C3E; Tue, 27 May 2008 10:22:27 -0700 (PDT)
X-Original-To: syslog@core3.amsl.com
Delivered-To: syslog@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C502D3A6C2F for <syslog@core3.amsl.com>; Tue, 27 May 2008 10:22:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.274
X-Spam-Level:
X-Spam-Status: No, score=-2.274 tagged_above=-999 required=5 tests=[AWL=0.325, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MiQiaFiqIZ6m for <syslog@core3.amsl.com>; Tue, 27 May 2008 10:22:20 -0700 (PDT)
Received: from mk-outboundfilter-2.mail.uk.tiscali.com (mk-outboundfilter-2.mail.uk.tiscali.com [212.74.114.38]) by core3.amsl.com (Postfix) with ESMTP id 2228F3A6950 for <syslog@ietf.org>; Tue, 27 May 2008 10:22:19 -0700 (PDT)
X-Trace: 87546762/mk-outboundfilter-2.mail.uk.tiscali.com/PIPEX/$ACCEPTED/pipex-customers/62.188.135.43
X-SBRS: None
X-RemoteIP: 62.188.135.43
X-IP-MAIL-FROM: cfinss@dial.pipex.com
X-IP-BHB: Once
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: ApsEAFTgO0g+vIcr/2dsb2JhbACLb6IaAw
X-IronPort-AV: E=Sophos;i="4.27,549,1204502400"; d="scan'208";a="87546762"
X-IP-Direction: IN
Received: from 1cust43.tnt6.lnd4.gbr.da.uu.net (HELO allison) ([62.188.135.43]) by smtp.pipex.tiscali.co.uk with SMTP; 27 May 2008 18:22:21 +0100
Message-ID: <007801c8c015$31cb1c60$0601a8c0@allison>
From: "tom.petch" <cfinss@dial.pipex.com>
To: Rainer Gerhards <rgerhards@hq.adiscon.com>, syslog@ietf.org
References: <AC1CFD94F59A264488DC2BEC3E890DE505DFD90C@xmb-sjc-225.amer.cisco.com><577465F99B41C842AAFBE9ED71E70ABA309093@grfint2.intern.adiscon.com><1696498986EFEC4D9153717DA325CB72B36A0B@vaebe104.NOE.Nokia.com><1211806792.27593.11.camel@localhost.localdomain><1696498986EFEC4D9153717DA325CB72B36AAC@vaebe104.NOE.Nokia.com> <577465F99B41C842AAFBE9ED71E70ABA3090A9@grfint2.intern.adiscon.com>
Date: Tue, 27 May 2008 18:06:45 +0200
MIME-Version: 1.0
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Subject: Re: [Syslog] Some revised text for syslog TLS
X-BeenThere: syslog@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: "tom.petch" <cfinss@dial.pipex.com>
List-Id: Security Issues in Network Event Logging <syslog.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/pipermail/syslog>
List-Post: <mailto:syslog@ietf.org>
List-Help: <mailto:syslog-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/syslog>, <mailto:syslog-request@ietf.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: syslog-bounces@ietf.org
Errors-To: syslog-bounces@ietf.org

----- Original Message ----- 
From: "Rainer Gerhards" <rgerhards@hq.adiscon.com>
To: <syslog@ietf.org>
Sent: Monday, May 26, 2008 3:26 PM
Subject: Re: [Syslog] Some revised text for syslog TLS


> > > Please keep in mind that my message was related to the question if
> > > there is a use case for using IPs inside a certificate. As I said
> > > above, there is.
> > 
> > Ok. Do you think this use case is important enough to keep this
> > feature (checking IPAddress subjectAltName) as part of the "MUST
> > implement" baseline?
> 
> No, I don't think it is a MUST. 
> 

But I would like it to be a SHOULD.

Tom Petch

> > (Joe's latest text already has other forms of name comparison as
> > optional: "Implementations MAY also support authorization based on
> > other attributes.  For example, the authorization of a device Serial
> > Number against the SerialNumber portion of the Subject Distinguished
> > Name [...]")
> 
> This should take care of it well enough.
> 
> Rainer
> _______________________________________________
> Syslog mailing list
> Syslog@ietf.org
> https://www.ietf.org/mailman/listinfo/syslog
_______________________________________________
Syslog mailing list
Syslog@ietf.org
https://www.ietf.org/mailman/listinfo/syslog

v2.23.0 | Report a Bug | By Email