Subject: Re: [NGO] comments on CANMOD BoF

From: Mehmet Ersue <[email-masked]>
Date: Mon, 17 Mar 2008 12:57:42 +0000 (GMT)

Hi Andy, Phil,

> Ignoring access control completely is not something the IESG 
> should allow in the charter.

this is true. We need an access control mechanism for NETCONF,
i.e. for the NETCONF protocols _and_ the data model access,
which need to fit together. 
We postponed this issue since we didn't know what the requirements 
of the DML will be. I guess we should start this work now together 
with the DML drafting. 

Actually it doesn't really matter where this is developed, in the 
NETCONF WG or the sister WG NETMOD. 

PS: I CC Kaushik, who showed some interest to work on Access 
Control during the CANMOD BoF. May be Andy and Kaushik can 
have a chat on this.

Cheers, 
Mehmet 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of ext Andy Bierman
> Sent: Sunday, March 16, 2008 2:26 AM
> To: Phil Shafer
> Cc: NETCONF Goes On
> Subject: Re: [NGO] comments on CANMOD BoF
> 
> Phil Shafer wrote:
> > Andy Bierman writes:
> >> Ignoring access control
> >> completely is not something the IESG should allow in the charter.
> > 
> > On access control, we have zero realistic proposals on the table.
> > Please feel free to propose something and hopefully you'll see the
> > same sort of responding proposals as we saw with YANG and we can
> > get a concensus built there.  But this is an effort that can and
> > should be separated from the modeling work.
> > 
> 
> 
> There have been several proposals made to the WG.
> All of them have been ignored by the WG.
> IMO, they were all realistic proposals.
> 
> It is clear the NETCONF WG wants to ignore security,
> just like RMONMIB and IPFIX wanted to ignore congestion
> and run over UDP.
> 
> Standard configuration management based on NETCONF requires more
> than a DML.  The NETMOD WG (if there ever is one) should deal
> with the entire problem of standardized CM, which includes
> secure operation in a multi-user environment.
> 
> If the WG agrees that granular access control is pointless and the
> standard access control model for NETCONF should be
> "root access or nothing", then that should be written
> down in a standard.  I hope the IESG rejects it though,
> and forces NETCONF to consider security more carefully.
> 
> 
> > Thanks,
> >  Phil
> > 
> > 
> > 
> 
> Andy
> 
> _______________________________________________
> NGO mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ngo
> 

      Lesen Sie Ihre E-Mails auf dem Handy.
www.yahoo.de/go

_______________________________________________
NGO mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ngo