Subject: [secdir] Review of draft-ietf-netmod-interfaces-cfg-10

From: Shawn Emery <[email-masked]>
Date: Mon, 13 May 2013 01:35:04 -0600

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the IESG. 
These comments were written primarily for the benefit of the security 
area directors. Document editors and WG chairs should treat these 
comments just like any other last call comments.

This internet-draft specifies a data model used for the management of 
network interfaces.

The security considerations section does exist and discusses that the 
data is made available through the NETCONF protocol.  NETCONF uses SSH 
to access and transfer said data.  It goes on to discuss the 
implications of unattended access to list and leaf data, but does not 
provide guidance on how to mitigate against unauthorized access.  If 
this is discussed in the NETCONF draft then this draft should at least 
provide this reference.

General comments:

None.

Editorial comments:

None.

Shawn.
--

---

From: Martin Bjorklund <[email-masked]>
Date: Mon, 13 May 2013 09:44:41 +0200 (CEST)

Hi,

Shawn Emery <[email-masked]> wrote:
> 
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG. These
> comments were written primarily for the benefit of the security area
> directors. Document editors and WG chairs should treat these comments just
> like any other last call comments.
> 
> This internet-draft specifies a data model used for the management of network
> interfaces.
> 
> The security considerations section does exist and discusses that the data is
> made available through the NETCONF protocol.  NETCONF uses SSH to access and
> transfer said data.  It goes on to discuss the implications of unattended
> access to list and leaf data, but does not provide guidance on how to mitigate
> against unauthorized access.  If this is discussed in the NETCONF draft then
> this draft should at least provide this reference.

This is discussed in the NETCONF Access Control Model (RFC 6536).  We
got the same comment also from other reviewers, and we will update the
first paragraph to be:

  The YANG module defined in this memo is designed to be accessed via
  the NETCONF protocol ^RFC6241^.  The lowest NETCONF layer is the
  secure transport layer and the mandatory-to-implement secure
  transport is SSH ^RFC6242^.  The NETCONF access control model
  ^RFC6536^ provides the means to restrict access for particular
  NETCONF users to a pre-configured subset of all available NETCONF
  protocol operations and content.

This text will go into the Security Considerations template that is
used for other YANG module documents as well.

I hope this addresses your concern.

/martin

---

From: Benoit Claise <[email-masked]>
Date: Mon, 13 May 2013 12:23:46 +0200

Hi Shawn,
>    protocol operations and content.

Note that this text has been recently updated  at 
http://trac.tools.ietf.org/area/ops/trac/wiki/yang-security-guidelines

Regards, Benoit

---

From: Shawn Emery <[email-masked]>
Date: Mon, 20 May 2013 10:48:13 -0600

> I hope this addresses your concern.

Looks reasonable.

Shawn.
--