Subject: [secdir] SecDir review of draft-ietf-opsawg-syslog-msg-mib-04

From: Magnus Nyström <[email-masked]>
Date: Mon, 20 Jul 2009 11:29:35 -0400 (Eastern Daylight Time)

I have reviewed this document as part of the security directorate's ongoing 
effort to review all IETF documents being processed by the IESG. These 
comments were written primarily for the benefit of the security area 
directors.  Document editors and WG chairs should treat these comments just 
like any other last call comments.

Background
----------
This document defines a MIB module for use when mapping SYSLOG messages to 
SNMP notifications.

Comments
--------

- In the SYSLOG-MSG-MIB module, the syslogMsgSDTable is defined with the
   syntax

   SEQUENCE OF SyslogMsgSDEntry

   Would it make sense to restrict this with an upper (and perhaps lower)
   bound to reduce the risk of either non-interop or potential attacks?
   E.g. like

   SEQUENCE SIZE (1..<upper-bound>) OF SyslogMsgSDEntry

   where <upper-bound> is replaced with something reasonable?

- (Editorial) In the Security Considerations section, there is a paragraph
   recommending against deployment of earlier versions of SNMP. For
   clarity and correctness ("NOT RECOMMENDED" is not a key word) I suggest
   this paragraph is rewritten to (several changes in the below):

    Further, SNMP versions prior to SNMPv3 SHOULD NOT be deployed.
    Instead, SNMPv3 with enabled cryptographic security SHOULD be deployed.
    It is then a customer/operator responsibility to ensure that the SNMP
    entity giving access to an instance of this MIB module is properly
    configured to give access to the objects only to those principals
    (users) that indeed have legitimate rights to GET or SET
    (change/create/delete) them.

-- Magnus

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Mon, 20 Jul 2009 17:38:59 +0200

Hi Magnus,

Thank you for the review. 

I will let the authors respond on the rest, but I have one comment about the following: 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Magnus Nystr?m

>    this paragraph is rewritten to (several changes in the below):

Actually RFC 2119 says: 

  4. SHOULD NOT   This phrase, or the phrase "NOT RECOMMENDED" mean that
   there may exist valid reasons in particular circumstances when the
   particular behavior is acceptable or even useful, but the full
   implications should be understood and the case carefully weighed
   before implementing any behavior described with this label.

NOT RECOMMENDED is thus accepted as a synonim to SHOULD NOT if the syntax of the phrase demands it. 

The current boilerplate for Security Considerations sections described at http://www.ops.ietf.org/mib-security.html was carefully crafted by the Security AD's and OPS AD's a few years ago, and is used since in all RFCs that define MIB modules. I would not recommend using a different wording, unless there is a good reason and the current AD's agree on the change. 

Thanks and Regards,

Dan

---

From: "David Harrington" <[email-masked]>
Date: Mon, 20 Jul 2009 16:37:49 -0400

Hi,

MIBs arewritten using SMIv2. I don't believe SMIv2 supports the range
on a SEQUENCE.

As Dan pointed out, the recommendation of SNMP versions is boilerplate
that was worked out between Security and OPS ADs.

dbh 

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Magnus Nyström
> Sent: Monday, July 20, 2009 11:30 AM
> To: [email-masked]; [email-masked]; [email-masked]; 
> [email-masked]; [email-masked]; 
> [email-masked]; [email-masked]; [email-masked]
> Subject: [secdir] SecDir review of
draft-ietf-opsawg-syslog-msg-mib-04

> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
>