Subject: [NGO] comments on CANMOD BoF

From: Andy Bierman <[email-masked]>
Date: Fri, 14 Mar 2008 20:24:23 -0700

Hi,

I was encouraged to hear that some consensus on a path forward
with YANG as the high-level DML, and standard XML languages
as the low-level DMLs.

I am still concerned about the absence of 'coexistence with
SNMP MIBs' in the game plan.  I have a common and important use case:

What if a WG wants to create a NETCONF MIB module to configure
a protocol, which has existing detailed capabilities already
standardized in an SMIv2 module?  What if the WG wants machine-readable,
cohesive mechanisms to indicate that certain config features/knobs
are only available or applicable if certain MIB objects have particular
values?

Randy's answer at the Bof was that WGs will just have to
use SNMP, not NETCONF, to configure their protocols.
I strongly object to this solution approach, and expect the
NETMOD architecture to fully account for SMIv2 objects, TCs,
and notifications, plus SYSLOG notifications, and standard
RPC operations added by other WGs.

I also expect the WG charter to include a coherent and robust plan
for operational security, that includes a standard access control model.
This must fully account for all aspects of NETCONF protocol behavior,
including vendor actions which interact with the same configuration
data as standard operations.

Anything less would be a toy, not suitable for real networks.

Andy

_______________________________________________
NGO mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ngo

---

From: Phil Shafer <[email-masked]>
Date: Sat, 15 Mar 2008 18:03:48 -0400

>for operational security, that includes a standard access control model.

Please point us to a usable example of a coherent and robust plan.
Requiring this in the charter for a NETCONF modeling language puts
the cart before the ameoba.

Thanks,
 Phil

---

From: Yoshifumi Atarashi <[email-masked]>
Date: Sun, 16 Mar 2008 08:05:59 +0900

> with YANG as the high-level DML, and standard XML languages

What are 'high-level' and 'low-level'?
We don't define level　of data model yet.
I think we need discussion about high-level DML, especially
descripution ability, capability and so on.

Generally in the XML world,
High-level relationship key words are abstractness, designation, 
ontology, semantic, etc.
So we imagine high-level descripution is owl/RDF.
and low-level descripution is xsd or RelaxNG.

regards
-------
   Yoshifumi Atarashi

---

From: Andy Bierman <[email-masked]>
Date: Sat, 15 Mar 2008 16:31:39 -0700

> the cart before the ameoba.

The NETCONF WG was already tasked with developing a set of
requirements for access control, and this work item was
dropped from the charter.

IMO, this is in the same category as vendors designing protocols
to run over UDP, without any regard for congestion control,
and the IESG won't let them standardize that.  Oh well. Nice try.

I don't have to come up with a complete accepted solution.
Neither does a WG creating a standardized NETCONF content solution.
IMO, the WG charter must have a coherent plan for all aspects
of a secure working NETCONF CM system.  Ignoring access control
completely is not something the IESG should allow in the charter.

Andy

---

From: Phil Shafer <[email-masked]>
Date: Sat, 15 Mar 2008 20:02:35 -0400

Andy Bierman writes:
>Ignoring access control

On access control, we have zero realistic proposals on the table.
Please feel free to propose something and hopefully you'll see the
same sort of responding proposals as we saw with YANG and we can
get a concensus built there.  But this is an effort that can and
should be separated from the modeling work.

Thanks,
 Phil

---

From: Andy Bierman <[email-masked]>
Date: Sat, 15 Mar 2008 18:26:26 -0700

> should be separated from the modeling work.

There have been several proposals made to the WG.
All of them have been ignored by the WG.
IMO, they were all realistic proposals.

It is clear the NETCONF WG wants to ignore security,
just like RMONMIB and IPFIX wanted to ignore congestion
and run over UDP.

Standard configuration management based on NETCONF requires more
than a DML.  The NETMOD WG (if there ever is one) should deal
with the entire problem of standardized CM, which includes
secure operation in a multi-user environment.

If the WG agrees that granular access control is pointless and the
standard access control model for NETCONF should be
"root access or nothing", then that should be written
down in a standard.  I hope the IESG rejects it though,
and forces NETCONF to consider security more carefully.

Andy

---

From: Phil Shafer <[email-masked]>
Date: Sun, 16 Mar 2008 13:21:30 -0400

Andy Bierman writes:
>The NETMOD WG (if there ever is one) should deal

With this approach, we'd still be working on the NETCONF draft.  We
need to find what we agree on, build concensus on that, publish,
gain experience, learn, and evolve.

If the plan is "all or nothing", we'll get nothing.

Thanks,
 Phil

---

From: Andy Bierman <[email-masked]>
Date: Sun, 16 Mar 2008 12:19:26 -0700

> If the plan is "all or nothing", we'll get nothing.

The NETCONF access control model is "all or nothing",
not the NETCONF feature development plan.  That is in its
3rd phase, and new stuff like partial-locking and yet another
optional transport (which is only needed to avoid the mandatory
transport) are given higher priority than security.

You have to design the 2nd floor of the house, even though
you start out by building the first floor.  If you don't,
at best the project will cost 10X more expensive than it should,
and at worse, the house will collapse when you add the weight
the load-bearing walls on the first floor were never designed to handle.

A standard access control model is clearly needed.
Every NETCONF implementation has its own proprietary ACM.
The requirements for standardized access control could impact
the NETMOD architecture and the DML.  Ignoring access control
and bolting it on later might be a huge mistake.

So by 'all', I mean a coherent and well-planned execution strategy
to reach a complete standardized CM solution for NETCONF,
as opposed to an ad-hoc free-for-all that continues to produce
zero writable standard objects for NETCONF.

Andy

---

From: Leif Johansson <[email-masked]>
Date: Sun, 16 Mar 2008 20:35:24 +0100

> with YANG as the high-level DML, and standard XML languages

I don't recall hearing that discussion during the BOF. Do you have notes?

	Cheers Leif

---

From: Phil Shafer <[email-masked]>
Date: Sun, 16 Mar 2008 18:59:01 -0400

Andy Bierman writes:
>to reach a complete standardized CM solution for NETCONF...

Please feel free to propose such a strategy, or send a pointer to
an existing one.

Thanks,
 Phil

---

From: Andy Bierman <[email-masked]>
Date: Sun, 16 Mar 2008 16:02:27 -0700

> If the plan is "all or nothing", we'll get nothing.

This is a strawman.  Nobody ever said 'all'.
The ADs said we should write a requirements spec on access control,
2 IETFs ago.  I might just do that, if I find a co-author,
even though I don't have the time.

The first step is understanding the requirements and a few details for:

  - Identity of users
  - Identity of roles
  - NETCONF CRUDX access granularity requirements
  - Interaction between RPC methods and config data
  - Interaction with SNMP access control (VACM)
  - Interaction with partial locking
  - Interaction between NETCONF sessions (e.g., per-session or per-user)
  - Interaction with general purpose access control, firewalls,
    and other security mechanisms in the device
  - Data modeling language requirements to support access control
  - NETCONF access control configuration requirements
  - ???

Andy

---

From: Balazs Lengyel <[email-masked]>
Date: Mon, 17 Mar 2008 11:19:15 +0100

While agreeing that access control is important, I would also mention that we just made the 
very first step for the DML. We still have many months of hard work before us, so if we loose 
focus we are doomed.

Balazs

-- 
Balazs Lengyel                       Ericsson Hungary Ltd.
TSP System Manager
ECN: 831 7320                        Fax: +36 1 4377792
Tel: +36-1-437-7320     email: [email-masked]
_______________________________________________
NGO mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ngo

---

From: Andy Bierman <[email-masked]>
Date: Mon, 17 Mar 2008 20:38:27 -0700

Balazs Lengyel wrote:
> While agreeing that access control is important, I would also mention 
> that we just made the very first step for the DML. We still have many 
> months of hard work before us, so if we loose focus we are doomed.
> 

Fine -- forget access control.  Go back to telnet for all I care ;-)

But when drafts like partial locking have statements such as
"must have some access rights", that is a pretty clear indication
that the WG needs to consider issues like what is an access right?,
and what does it mean to 'have', 'permit' or 'deny' that access right?
Pretty basic stuff.

(Remember the emphatic reason the WG could not work on a standard
ACM 8 months ago?  "We don't understand the requirements!".
I'm glad that the WG understands them now :-)

Andy

---

From: Jon Saperia <[email-masked]>
Date: Tue, 18 Mar 2008 07:33:52 -0400

Seems like there are two schools of thought and approach represented  
in the threads over the past couple days.
Understand a single issue, work on it, more or less to the exclusion  
of other items and move on to whatever is next, repeat.
Understand a wider scope of the problem, and include key components of  
the system/architecture.

The former can produce faster incremental results, while the later has  
the advantage of producing a system that will more likely meet  
'customer' needs when deployed and require fewer incremental tweaks.

My take on the recent history is that the rate of progress with the  
single issue approach has been too slow. At least some of the time has  
been taken up with the administrative overhead associated with IETF  
working group spin ups and charter mods.  It seems that for this new  
effort, all the issues should be put on the table so a 'complete'  
management environment can be provided for all our customers.  All  
should be included in the charter and associated schedule.  The get  
worked on as resources are available just like any other engineering  
effort.

So,  I would certainly put into the list items like:
An administrative framework/security.
Integration of configuration with monitoring and event-based data in  
SNMP - this is where issues of SMI coexistence/translation etc would  
be dealt with.
Any modifications necessary to the base protocols to support the first  
two items.

My guess is that the group could probably reach consensus on the  
issues top level issues for a charter relatively rapidly.  Then with a  
path in place, discussion could focus on one or more elements at a  
time, but with the understanding that there are pieces to be put  
together.

/jon

---

From: "David Harrington" <[email-masked]>
Date: Tue, 18 Mar 2008 13:08:14 -0400

Hi Balazs,

You want to put all resources to work on one problem. There are
problems that others could work on in parallel with the DML effort.
Not every problem should be worked on in separate WGs; As John Saperia
points out, the overhead  of that approach is simply too high.

We need to encourage more people to get involved and produce concrete
proposals for other aspects of the problem space.

Again, as john points out, this would be easier if we actually took
some time to define a high level framework about the pieces that need
to be done, and how they must fit together.

This one-piece-at-a-time-with-blinders-on is likely to produce a bunch
of pieces that do not integrate well as a system.

dbh

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Balazs Lengyel
> Sent: Monday, March 17, 2008 6:19 AM
> To: Andy Bierman
> Cc: NETCONF Goes On
> Subject: Re: [NGO] comments on CANMOD BoF
>