Subject: [secdir] Review of draft-ietf-netmod-schema-mount-10

From: Shawn Emery <[email-masked]>
Date: Sun, 24 Jun 2018 23:27:40 -0600

Reviewer: Shawn M. Emery
Review result: Ready with nits

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security
area directors. Document editors and WG chairs should treat these
comments just like any other last call comments.

This draft specifies a schema for YANG module mount points for yet another
specified schema location.

The security considerations section does exist and refers to transport
security
through SSH and HTTPS for NETCONF and RESTCONF, respectively.  For
authorization, the spec refers to RFC 8341 for controlling NETCONF and
RESTCONF user access.  Data that would be considered sensitive or subject
to attack is briefly described and prescribes read access controls for said
data.
I agree with the authors' assertions.

General comments:

None.

Editorial comments:

OLD:

These are the subtrees and data nodes and their sensitivity/vulnerability:

NEW:

The following should be considered for subtrees/data nodes and their
corresponding

sensitivity/vulnerability:

Shawn.
--

---

From: Ladislav Lhotka <[email-masked]>
Date: Mon, 25 Jun 2018 15:38:56 +0200

Hi Shawn,

thank you for the review, please see my comment below.

> sensitivity/vulnerability:

The OLD formulation actually comes from RFC 6087, section 6.1 (Security
Considerations Section Template). Your NEW formulation indeed looks
better, so we will use it in the present draft, and I will also send it
to the netmod mailing list in order to apply this change in
draft-ietf-netmod-rfc6087bis.

Thanks, Lada

-- 
Ladislav Lhotka
Head, CZ.NIC Labs
PGP Key ID: 0xB8F92B08A9F76C67

---

From: joel jaeggli <[email-masked]>
Date: Mon, 25 Jun 2018 08:41:01 -0600

> draft-ietf-netmod-rfc6087bis.
thank you