Subject: [Netconf] WG Consensus on options 1, 2, 3, 4, 5 for Enabling Third Party Authentication using Passwords

From: Mohamad Badra <[email-masked]>
Date: Tue, 27 May 2008 14:16:21 +0200

Dear all,

We would encourage any contribution that could be used in combination 
with existing user authentication databases. Please don't hesitate to 
submit your comments on the options described through "NETCONF over TLS" 
  [1] document in Appendix B, or to post your proposal on the mailing 
list to try to reach WG consensus.

[1] http://www.ietf.org/internet-drafts/draft-ietf-netconf-tls-02.txt

Best regards,
-- 
Mohamad Badra
CNRS - LIMOS Laboratory

_______________________________________________
Netconf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netconf

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 27 May 2008 14:41:49 +0200

> list to try to reach WG consensus.

My $.02 worth of comments:

: 1. Defining <user-login> RPC:

I share that the doubt that this will fly. Plain password
authentication is just one out of many authentication methods out
there.

: 2. Enhancing TLS:

Does not belong into the WG.

: 3. Running BEEP over TLS

This is already defined as part of the BEEP transport mapping.

: 4. Extending NETCONF with a message to start TLS

Extending NETCONF with a SASL hook is an architecture violation.From [email-masked]  Tue May 27 05:41:55 2008
Date: Tue, 27 May 2008 14:41:49 +0200
From: Juergen Schoenwaelder <[email-masked]>
To: Mohamad Badra <[email-masked]>
Mail-Followup-To: Mohamad Badra <[email-masked]>, [email-masked]
Cc: [email-masked]
Subject: Re: [Netconf] WG Consensus on options 1, 2, 3, 4,
	5 for Enabling	Third Party Authentication using Passwords
Reply-To: [email-masked]
Sender: [email-masked]

> list to try to reach WG consensus.

My $.02 worth of comments:

: 1. Defining <user-login> RPC:

I share that the doubt that this will fly. Plain password
authentication is just one out of many authentication methods out
there.

: 2. Enhancing TLS:

Does not belong into the WG.

: 3. Running BEEP over TLS

This is already defined as part of the BEEP transport mapping.

: 4. Extending NETCONF with a message to start TLS

Extending NETCONF with a SASL hook is an architecture viol But
this does not preclude the option that the TLS transport for NETCONF
does provide hooks for SASL.

: 5. Enable SSH (RFC4742 and TLS (as defined through this document:

This does not make any sense to me.

My suggestion is to actually do nothing to enable 3rd party
authentication using passwords in this document other then wording
things carefully such that something like this can be added in the
future should this need ever arise.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
Netconf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netconf

ation. But
this does not preclude the option that the TLS transport for NETCONF
does provide hooks for SASL.

: 5. Enable SSH (RFC4742 and TLS (as defined through this document:

This does not make any sense to me.

My suggestion is to actually do nothing to enable 3rd party
authentication using passwords in this document other then wording
things carefully such that something like this can be added in the
future should this need ever arise.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
Netconf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netconf

---

From: Mohamad Badra <[email-masked]>
Date: Tue, 27 May 2008 15:25:35 +0200

Juergen Schoenwaelder a écrit :

<snip>
 > future should this need ever arise.

I haven't any problem with that, this could be option #6 :)

Best regards,
Badra

---

From: Mohamad Badra <[email-masked]>
Date: Tue, 27 May 2008 15:25:35 +0200

<snip>

Best regards,
Badra