Subject: [nfsv4] Kathleen Moriarty's Discuss on draft-ietf-nfsv4-flex-files-15: (with DISCUSS)

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 24 Jan 2018 08:42:00 -0800

Kathleen Moriarty has entered the following ballot position for
draft-ietf-nfsv4-flex-files-15: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-nfsv4-flex-files/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thanks for your response to the SecDir review.  I see the proposed changes have
not been integrated yet.  This discuss will be resolved when the SecDir review
changes have been included.

https://mailarchive.ietf.org/arch/msg/secdir/HKdT2KjnWJFmzEPxlGcNH0OnUDg

---

From: Tom Haynes <[email-masked]>
Date: Wed, 24 Jan 2018 14:25:30 -0800

I purposely did not update the document to avoid confusion during this process.

There was an unanswered question in my last reply, namely concerning the use
of SHOULD versus MUST in the 3rd sentence below:

   It is RECOMMENDED to implement common access control methods at the
   storage device filesystem to allow only the metadata server root
   (super user) access to the storage device, and to set the owner of
   all directories holding data files to the root user.  This approach
   provides a practical model to enforce access control and fence off
   cooperative clients, but it can not protect against malicious
   clients; hence it provides a level of security equivalent to
   AUTH_SYS.  Communications between the metadata server and file server
   SHOULD be secure from eavesdroppers and man-in-the-middle protocol
   tampering.  The security measure could be due to physical security
   (e.g., the servers are co-located in a physically secure area), from
   encrypted communications, or some other technique.

> On Jan 24, 2018, at 8:42 AM, Kathleen Moriarty <[email-masked]> wrote:
> 

I purposely did not update the document to avoid confusion during this process.

There was an unanswered question in my last reply, namely concerning the use
of SHOULD versus MUST in the 3rd sentence below:

   It is RECOMMENDED to implement common access control methods at the
   storage device filesystem to allow only the metadata server root
   (super user) access to the storage device, and to set the owner of
   all directories holding data files to the root user.  This approach
   provides a practical model to enforce access control and fence off
   cooperative clients, but it can not protect against malicious
   clients; hence it provides a level of security equivalent to
   AUTH_SYS.  Communications between the metadata server and file server
   SHOULD be secure from eavesdroppers and man-in-the-middle protocol
   tampering.  The security measure could be due to physical security
   (e.g., the servers are co-located in a physically secure area), from
   encrypted communications, or some other technique.

> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nfsv4

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 24 Jan 2018 17:47:54 -0600

Kathleen and EKR,

On Jan 24, 2018 16:25, "Tom Haynes" <[email-masked]> wrote:

I purposely did not update the document to avoid confusion during this
process.

> https://datatracker.ietf.org/doc/draft-ietf-nfsv4-flex-files/

I purposely did not update the document to avoid confusion during this
process.

Do you folks have any thoughts about whether "secure from eavesdroppers"
ought to be SHOULD or MUST?

IIUC, Thomas was reluctant to specify MUST ... and since we're saying that
co-location in a secure area is one of the options, I'm not sure why this
would be either SHOULD or MUST in the first place.

Conformance test cases for that requirement would be a riot ... :-)

Spencer

---

From: Tom Haynes <[email-masked]>
Date: Wed, 24 Jan 2018 16:06:47 -0800

> On Jan 24, 2018, at 3:47 PM, Spencer Dawkins at IETF <[email-masked]> wrote:
> 
> Kathleen and EKR,
> 
> On Jan 24, 2018 16:25, "Tom Haynes" <[email-masked] <mailto:[email-masked]>> wrote:
> > On Jan 24, 2018, at 8:42 AM, Kathleen Moriarty <[email-masked] <mailto:[email-masked]>> wrote:
> >
> > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html <https://www.ietf.org/iesg/statement/discuss-criteria.html>
> > https://datatracker.ietf.org/doc/draft-ietf-nfsv4-flex-files/ <https://datatracker.ietf.org/doc/draft-ietf-nfsv4-flex-files/>
> >
> >
> >
> Do you folks have any thoughts about whether "secure from eavesdroppers" ought to be SHOULD or MUST?
> 
> IIUC, Thomas was reluctant to specify MUST ... and since we're saying that co-location in a secure area is one of the options, I'm not sure why this would be either SHOULD or MUST in the first place. 
> 

Customer has two data centers and wants to do client-side mirroring between them.

I would certainly hope they have some form of secure link between the sites, but
I can’t force that on them!

> Conformance test cases for that requirement would be a riot ... :-)

Yes, but I hate lying ahead of time.:-(

> Spencer
> 
> > https://mailarchive.ietf.org/arch/msg/secdir/HKdT2KjnWJFmzEPxlGcNH0OnUDg <https://mailarchive.ietf.org/arch/msg/secdir/HKdT2KjnWJFmzEPxlGcNH0OnUDg>
> >
> >
> >
> >
> > [email-masked] <mailto:[email-masked]>
> > https://www.ietf.org/mailman/listinfo/nfsv4 <https://www.ietf.org/mailman/listinfo/nfsv4>
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/nfsv4 <https://www.ietf.org/mailman/listinfo/nfsv4>

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 24 Jan 2018 21:28:37 -0500

Hi,

First off, I was less concerned about this point than the proposed
text discussed and other points. Having said that...

>    encrypted communications, or some other technique.

I think rephrasing to RECOMMENDED would be good here.

Thank you,
Kathleen

>
>> On Jan 24, 2018, at 8:42 AM, Kathleen Moriarty
>> <[email-masked]> wrote:
>>

-- 

Best regards,
Kathleen

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Wed, 24 Jan 2018 22:58:32 -0600

Cool.

On Jan 24, 2018 20:29, "Kathleen Moriarty" <[email-masked]>
wrote:

Hi,

So, Thomas, do you have any more questions I should be chasing?

Spencer

Thank you,
Kathleen

>> Thanks for your response to the SecDir review.  I see the proposed
changes
>> have

--

Best regards,
Kathleen

---

From: Thomas Haynes <[email-masked]>
Date: Wed, 24 Jan 2018 23:56:54 -0800

> On Jan 24, 2018, at 8:58 PM, Spencer Dawkins at IETF <[email-masked]> wrote:
> 
> Cool.
> 
> On Jan 24, 2018 20:29, "Kathleen Moriarty" <[email-masked] <mailto:[email-masked]>> wrote:
> Hi,
> 
> <[email-masked] <mailto:[email-masked]>> wrote:
> > Kathleen and EKR,
> >
> >

Hi Kathleen,

I think you are proposing:

It is RECOMMENDED that the communication between the metadata server and storage device be secure ….

> So, Thomas, do you have any more questions I should be chasing?

Hi Spencer,

Yes, what is the difference between SHOULD and RECOMMENDED? It must be a nuance I am missing...

From RFC2119, I don’t see the difference.
3. SHOULD   This word, or the adjective "RECOMMENDED", mean that there
   may exist valid reasons in particular circumstances to ignore a
   particular item, but the full implications must be understood and
   carefully weighed before choosing a different course.
BTW - the text above is from the proposed 16th copy of the draft. Once we get past this issue,
I will submit it.

Thanks,
Tom

> >> <[email-masked] <mailto:[email-masked]>> wrote:
> >>

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 25 Jan 2018 06:45:02 -0500

Hi Thomas,

Sent from my mobile device

> On Jan 25, 2018, at 2:56 AM, Thomas Haynes <[email-masked]> wrote:
> 
> 
> 
>> On Jan 24, 2018 20:29, "Kathleen Moriarty" <[email-masked]> wrote:
>> Hi,
>> 
Yes, thank you!
Kathleen

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Thu, 25 Jan 2018 05:47:47 -0600

Hi, Thomas,

On Jan 25, 2018 1:56 AM, "Thomas Haynes" <[email-masked]> wrote:

On Jan 24, 2018, at 8:58 PM, Spencer Dawkins at IETF <
[email-masked]> wrote:

Cool.

Hi,

Hi Kathleen,

It is RECOMMENDED that the communication between the metadata server and
storage device be secure ….

Hi Spencer,

Yes, what is the difference between SHOULD and RECOMMENDED? It must be a
nuance I am missing...

BTW - the text above is from the proposed 16th copy of the draft. Once we
get past this issue,
I will submit it.

We will likely chat about this on today's telechat, but I read Kathleen's
response as "no, it doesn't have to be MUST".

The switch between SHOULD and RECOMMENDED was probably not significant. I
don't think there's a difference,  either.

Spencer

Thanks,
Tom

Spencer

Thank you,
Kathleen

changes

--

Best regards,
Kathleen

---

From: Tom Haynes <[email-masked]>
Date: Thu, 25 Jan 2018 10:50:54 -0800

> On Jan 25, 2018, at 3:47 AM, Spencer Dawkins at IETF <[email-masked]> wrote:
> 
> Hi, Thomas,
> 
> On Jan 25, 2018 1:56 AM, "Thomas Haynes" <[email-masked] <mailto:[email-masked]>> wrote:
> 
> 
>> On Jan 24, 2018, at 8:58 PM, Spencer Dawkins at IETF <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Cool.
>> 
> We will likely chat about this on today's telechat, but I read Kathleen's response as "no, it doesn't have to be MUST".
> 
> The switch between SHOULD and RECOMMENDED was probably not significant. I don't think there's a difference,  either.
> 
> Spencer
> 

Hi Spencer,

Great, as Kathleen has ack’ed the proposed change, I went with it.

Thanks to both of you!
Tom

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 25 Jan 2018 14:42:06 -0500

Hi Tom,

Please let me know when you post the new version.

Thanks,
Kathleen

On Thu, Jan 25, 2018 at 1:50 PM, Tom Haynes <[email-masked]> wrote:
> On Jan 24, 2018 20:29, "Kathleen Moriarty"
> <[email-masked]> wrote:
>
> Hi,
>

-- 

Best regards,
Kathleen

---

From: Tom Haynes <[email-masked]>
Date: Thu, 25 Jan 2018 15:51:10 -0800

Hi Kathleen,

It is posted, thanks for the review.

Tom

> On Jan 25, 2018, at 11:42 AM, Kathleen Moriarty <[email-masked]> wrote:
> 
> Hi Tom,
>