[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: On SSH ports


Hi Eliot,

At 01:52 PM 2/5/2004 -0500, Eliot Lear wrote:
Egads... I could argue either side of the port issue for SSH. One the one hand, its primary use in NETWORK devices today is configuration, and so since the primary use isn't really changing, the port doesn't need to and shouldn't change.

On the other hand, if the primary use becomes something OTHER than network configuration (and there might be a good argument for this), then we should get this right the first time and use a different port.

Do I have the parameters of the decision about right? 

This is certainly how I would think of it.  I think that operators who want
to manage their networking equipment remotely have SSH access to the CLI
enabled today, so I don't see how adding a netconf subsystem to that same
SSH server fundamentally changes the security picture.  In many ways,
NETCONF/SSH could be viewed as a more computer-friendly way to access the
CLI.  The current CLI will probably remain as a more human-friendly
interface.

So, what do we gain by specifying that NETCONF/SSH should run over
a different port?

BTW, I just checked a couple of SSH clients, and they both include a
-p option to set the server port.  So, changing the port would be
consistent with existing clients, if we choose to do that.


Eliot


--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>



--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>