Subject: [TICTOC] Secdir last call review of draft-ietf-tictoc-1588v2-yang-10

From: Samuel Weiler <[email-masked]>
Date: Wed, 03 Oct 2018 08:18:55 -0700

Reviewer: Samuel Weiler
Review result: Has Issues

I wonder whether there should be a requirement to use authentication when
making updates.  As the doc says:

   Write operations (e.g., edit-config) to these data nodes without
   proper protection can have a negative effect on network operations.

I'm sure someone will argue "if this is used in a closed network, we can avoid
the use of authentication".  Prudence suggests that "closed" networks don't
remain that way forever, and defense-in-depth is advisable.  Let's add a MUST
or at least a SHOULD.

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 3 Oct 2018 21:49:53 -0500

> making updates.  As the doc says:

The NETCONF and RESTCONF secure transport layers already handle the
authentication requirements.  E.g., RFC 8040 Section 2.5:

   The RESTCONF server MUST authenticate client access to any protected
   resource.  If the RESTCONF client is not authenticated, the server
   SHOULD send an HTTP response with a "401 Unauthorized" status-line,
   as defined in Section 3.1 of [RFC7235].  The error-tag value
   "access-denied" is used in this case.

But thank you for doing the review, and you're right that this is
important!

-Ben

---

From: Jiangyuanlong <[email-masked]>
Date: Thu, 4 Oct 2018 09:14:55 +0000

Ben and Samuel,

Yes, the draft says:" The lowest NETCONF layer is the secure transport layer, and the
   mandatory-to-implement secure transport is Secure Shell (SSH)
   [RFC6242]. The lowest RESTCONF layer is HTTPS, and the mandatory-
   to-implement secure transport is TLS [RFC8446]." Thus authentication is a mandatory part of this layer.
BTW, the security considerations in this draft are fully in accordance with "Guidelines for Authors and Reviewers of YANG Data Model Documents" https://tools.ietf.org/html/draft-ietf-netmod-rfc6087bis-20#page-13 (which is now in RFC Editor Queue), and all future YANG docs developed in the IETF are requested to follow its guidelines).

Thanks,
Yuanlong

> -----Original Message-----
> From: Benjamin Kaduk [mailto:[email-masked]]
> Sent: Thursday, October 04, 2018 10:50 AM
> To: Samuel Weiler
> Cc: [email-masked]; [email-masked]; [email-masked];
> [email-masked]
> Subject: Re: Secdir last call review of draft-ietf-tictoc-1588v2-yang-10
>