Re: [Syslog] Some revised text for syslog TLS

Inline
Tom Petch

----- Original Message -----
From: "Rainer Gerhards" <rgerhards@hq.adiscon.com>
To: "tom.petch" <cfinss@dial.pipex.com>; "Joseph Salowey (jsalowey)"
<jsalowey@cisco.com>; <syslog@ietf.org>
Sent: Wednesday, May 28, 2008 10:35 AM
Subject: RE: [Syslog] Some revised text for syslog TLS

Tom,

inline...

<snip>

> > Do you or somebody else on this list (Tom?) have a clue why it may
be
> > useful to carry out such a check? (EDIT: check of IP address)
>
> You have lost me here.  Suppose I am a server and I want to check that
> syslog
> only comes from someone I trust so I will configure an identifier in
> the server
> and want security credentials to authenticate an assertion of that
> identity.
> The IP address is the identity, and the certificate the security
> credential.
>
> Or the host name is the identity and the certificate the security
> credential.
>
> Or the MAC address is the identity and the certificate the security
> credential.
>
> I do not see a difference (except that some identities are commoner
> than others
> as Pasi points out).

What is common is a big point. I think ipAddress inside certificates is
quite uncommon, so this may be a good indication that it doesn't justify
a MUST.

I have also thought about when this may be used at all. IMHO, this makes
only sense if the transport sender uses a proxy or is behind NAT. Using
a proxy for syslog senders is extremely uncommon. Being behind NAT is
uncommon (usually, syslog is not transmitted to the public Internet).
The remaining threat I see is that someone on the same local network
poisons ARP with a spoofed IP address and they tries to fool the syslog
server in listening to it. While possible, I think this is also quite
remote (but remote is not a good argument when it comes to security, I
know). What matters more is that this attack will NOT work if the
subject's name is checked against the certificate.

So what is the extra benefit of authorizing based on IP address? What is
the advantage of it? Is that so important that every syslog application
implementing MUST support it? I am even in doubt if if justifies a
SHOULD. To me it looks MAY would be sufficient, and this is covered by
the text. So I think the whole paragraph on ipAddress authentication can
simply be removed.

As a side-note, authentication based on IP addresses is even
problematic. In my experience IP ranges are more likely to change than
names, so sticking with names reduces the administrative cost when a
change is needed.

<tp>

I encounter networks where the devices do not have names, in any meaningful
manner (perhaps just a default sysName left in by the manufacturer).  Boxes are
identified by address, layer 2 - MAC - or layer 3 - IP.  What I am resisting is
the need to allocate and maintain a namespace where none exists at present.

This use of IP address is independent of what appears in the IP header of the
packet; here it is serving as an identity for the box not as something to put in
the source field of the IP header. In theory, if the IP address of the device
changed, then you could keep the old address as an identity but I think that
would be too bizarre.

Tom Petch
</tp>

Rainer
>
> Tom Petch

_______________________________________________
Syslog mailing list
Syslog@ietf.org
https://www.ietf.org/mailman/listinfo/syslog