Subject: [NGO] Access control for NETCONF

From: Ludwig Seitz <[email-masked]>
Date: Thu, 28 Jun 2007 14:02:32 +0200

Hello,
         
        We have uploaded an Internet draft about access control for
        netconf. It can be found here:
        
        http://www.ietf.org/internet-drafts/draft-seitz-netconf-xacml-00.txt
        
        We are Ludwig Seitz and Erik Rissanen. Ludwig Seitz is a
        researcher at Swedish Institute of Computer Science
        (www.sics.se) and Erik Rissanen has been a researcher at
        SICS, but has recently migrated to Axiomatics AB
        (www.axiomatics.com). We have both many years of experience
        in the area of access control for distributed systems and are
        now working in a joint research project with Ericsson
        Research (funded by Swedish research agency Vinnova) about
        access control and network management. (Balazs Lengyel and
        David Partain are aware of our work.)
        
        One of the activities in this project has been to address the
        problem how to perform access control without complete knowledge
        of the data model, with netconf as a concrete target protocol.
        Another requirement was to use some established general standard
        for access control policies, to avoid reinventing the wheel and
        in an attempt to reduce the number of access control languages
        that an administrator needs to learn.
        
        We have previous experience with a standardized access control
        language called XACML (the eXtensible Access Control Markup
        Language), and we have chosen to use XACML because it complied
        with these requirements.
        
        XACML is an OASIS standard and is an XML based access control
        language, see http://www.oasis-open.org/committees/xacml.
        XACML has been well received and is widely used, see
        http://docs.oasis-open.org/xacml/xacmlRefs.html
        
        XACML is a general purpose language based on attributes of
        subjects, resources and actions, with which it is easy to write
        access control policies conforming to different paradigms, such
        as
        role based access control, or other forms of rules. The
        benefits of this are that the same basic access control model
        can be used to write many different types of policies,
        depending on the particular needs of a product. 
        
        We have mapped the core netconf operations into a vocabulary
        of XACML attributes and are able to express access control
        policies for netconf in XACML.
        
        Our solution does not require access to the instance data of
        a data model in order to work. It is sufficient to see the
        RPC and the response to the RPC. We have been able to do this
        by taking an RPC centered approach, rather than a data
        centered approach.
        
        (BTW, since we have used a data model independent approach,
        we have encountered some ambiguities in the netconf spec and
        we have some suggestions for how the netconf document could
        be clarified, but we will post that in a separate email to this
        list.)
        
        We hope our work can contribute to any future work on
        standardized access control for netconf.
        
        If there is significant interest, we would be happy to give
        a presentation of this Internet draft in Chicago. We have
        been suggested a BOF where this could fit in (the Nee BOF). We
        would very much appreciate any feedback of the interest in
        discussing
        this topic at the Chicago meeting.
        
        Best regards,
        Ludwig Seitz and Erik Rissanen

_______________________________________________
NGO mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ngo

---

From: Andy Bierman <[email-masked]>
Date: Fri, 29 Jun 2007 05:49:12 -0700

>         Language), and we have chosen to use XACML because it complied

Which requirements?

There are several drafts on NETCONF Access Control now,
and none of them has attempted to specify any real NETCONF
access control requirements.

What are the use cases driving specific features in a generalized solution?

Unless there is some agreement on the problem space, I don't see how
the IETF can work on a solution.

>         policies for netconf in XACML.

IMO, this is really overkill for NETCONF.
XACML has massive flexibility, but at a big cost in complexity.
Experience with VACM in SNMP has shown that flexibility at the cost
of complexity deterred deployment in all cases, even the simple ones.

>         by taking an RPC centered approach, rather than a data

This solution relies on an Xpath expression (same as every other proposal)
to identify the data model subtree associated with the access rule.
IMO, only NETCONF Object Identifiers (/interfaces/interface/ifMtu)
and NETCONF Instance Identifiers (/interfaces/interface[ifName='eth0']/ifMtu)
can be used safely in an ACM.

I am very concerned about the unintended consequences of allowing
arbitrary Xpath expressions in access control rules, that result
in security holes which open and close dynamically in data-dependent ways.

>         Ludwig Seitz and Erik Rissanen

Andy