Subject: [Netconf] I-D Action: draft-ietf-netconf-reverse-ssh-04.txt

From: [email-masked]
Date: Mon, 07 Apr 2014 08:05:03 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Network Configuration Working Group of the IETF.

        Title           : Reverse SSH for NETCONF Call Home
        Author          : Kent Watsen
	Filename        : draft-ietf-netconf-reverse-ssh-04.txt
	Pages           : 10
	Date            : 2014-04-07

Abstract:
   This document presents a technique for a NETCONF server to initiate a
   SSH connection to a NETCONF client.  This is accomplished by the
   NETCONF client listening on IANA-assigned TCP port YYYY and starting
   the SSH client protocol immediately after accepting a TCP connection
   on it.  This role-reversal is necessary as the NETCONF server must
   also be the SSH server, in order for the NETCONF client to open the
   IANA-assigned SSH subsystem "netconf".

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-netconf-reverse-ssh/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-netconf-reverse-ssh-04

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-netconf-reverse-ssh-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Kent Watsen <[email-masked]>
Date: Mon, 7 Apr 2014 15:28:58 +0000

Please see the Change Log to see what's new in the draft.

I have not heard back from Steve yet on the Applicability Statement.  This
is the only open issue I'm aware of and otherwise the draft is ready for
last call.

The draft contains a reference to "draft-ietf-netconf-server-model", which
doesn't exist yet, as that draft was last submitted as
"draft-kwatsen-netconf-server" and hasn't been updated yet.  I don't
believe this is an issue since the reference happens in text that clearly
says the model is outside the scope.

PS: Bert, I'm already using the xml2rfc v2 script

Thanks,
Kent

On 4/7/14 11:05 AM, "[email-masked]" <[email-masked]>
wrote:

>_______________________________________________
>Netconf mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/netconf
>
>

---

From: t.petch <[email-masked]>
Date: Tue, 8 Apr 2014 17:44:45 +0100

Kent

I saw your exchange with Alan about the paragraph starting

"However, configuring distinct host keys on the management system
   doesn't scale well, which is an important consideration to a network
   management system.  "

That sounds plausible but seems to me to undermine the use of SSH for
NETCONF generally, nothing to do with call home.  Why is this not an
implicit update to RFC4742?

Tom Petch

----- Original Message -----
From: "Kent Watsen" <[email-masked]>
To: <[email-masked]>; <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, April 07, 2014 4:28 PM
> > This draft is a work item of the Network Configuration Working Group
of
> >the IETF.

---

From: Kent Watsen <[email-masked]>
Date: Tue, 8 Apr 2014 17:12:54 +0000

>implicit update to RFC4742?

True, using PKI-based keys (e.g., X.509) would help scale the rolling out
of deployments, regardless if TLS or SSH, and regardless if "normal" or
reversed.  So do we put something about this into all three documents, or
remove it from all three documents, citing that key-distribution is a
known problem?

If we do remove it from these documents, we'd have to be sure that stated
clearly in draft-ietf-netconf-zero-touch, as the solution described there
relies on vendors shipping devices with a PKI-based X.509 "entity
certificate" used for TLS and SSH NETCONF connections.

What do you think?

Thanks,
Kent