Subject: [Netconf] Simplified client-auth okay for call-home apps?

From: Kent Watsen <[email-masked]>
Date: Fri, 2 Jun 2017 01:35:38 +0000

During my presentation in Chicago, I presented the attached slide (I hope it comes through) and said that I'd take the issue to the list, and so here it goes.

As a recap, please recall that this issue regards how the ssh/tls client models, which are groupings, only enable a single password, public-key, or certificate.  This makes perfect sense when the ssh/tls client is initiating the connection to a specific ssh/tls server, in which case it should know exactly which auth-credentials to use.  The issue arises when the ssh/tls client is receiving call home [RFC 8071] connections from many ssh/tls servers, in which case it's unclear it the single client-auth credentials are okay, or if we'd need to configure a table mapping specific servers (e.g. serial-numbers) to specific client-auth credentials?

Of course, my goal is to let it be okay, because then we can use the same ssh/tls client groupings for both client-initiated and call-home scenarios.

So, here are some reasons why I think it might be okay:

1) it's actually not unusual for an NMS to use the same private key to log into many devices. This is perfectly secure, since each device is only configured with the NMS's public key or certificate, which is not a security risk.  The issue only arises when password-based auth is used, as then a different password SHOULD be used for each device (though I've seen more than one shop use a master password on many devices).

2) I believe that any client receiving large numbers of call-home connections (e.g., an NMS) will have its own NPI API for configuring many aspects of devices above and beyond the low-level auth details.  I don't think these kinds of clients are likely to use these modules in they're NBIs. To say it another way, I'm unsure that the call-home use-case represents a critical target market for these ssh/tls client models.

Thoughts on this?

Kent

---

From: Kent Watsen <[email-masked]>
Date: Tue, 13 Jun 2017 21:44:52 +0000

Since no one has spoken up on this, I'll keep the model the way it is.

Thanks,
Kent

--

Thoughts on this?

Kent