Re: NETCONF over TLS

[Mohamad Badra <badra@isima.fr>]

Balazs Lengyel writes:

> Hello,
> Why do you feel we need a new transport mapping? What would that give 
> us, why is it better then SSH and BEEP?
> You describe in your document what you intend to do, but please 
> motivate us by stating why is this a good idea?
> regards Balazs

Hi Lengyel,


It is not so easy to make a comparison between available security 
protocols for a specific application and to recommend a single one. It 
is easier to define a model threat for that application and then looking 
for a security solution. It is right that BEEP, SSH and other security 
protocols are able to meet the Netconf security requirements, but TLS 
could be a good alternative; even if other protocols could be able to 
give the same services.


There are several reasons why one might want to do Netconf over TLS, but 
please don't consider them as an XOR to the available solutions. some of 
these reasons:


- People are interesting to adopt TLS to become the unifying transport 
for, especially, SYSLOG, IPFIX, SNMP. And I think it is a good idea to 
do that for Netconf too. One argument is the following text posted out 
by David Harrington: [BCP72 identifies TLS as the transport security 
mechanism of choice when traffic is over TCP. SSH is recommended for 
remote login security, for providing channel-level security directly in 
the application. Netconf is designed to do "network configuration" as a 
replacement/supplement to the CLI running over a remote login session].


- TLS natively integrates key distribution and mutual authentication 
based on certificates, preshared keys, tokens, passwords and other 
credential types. If you are going to distribute vendor-certificates for 
your network's devices, TLS will be able to integrate the PKI use in a 
fashion way.


- TLS can provide a user-based access-control model (RFC 4681) and by 
its design it provides a facility for secure connection closure 
(close_notify alert) as well as a flexible way to encapsulate and 
protect EAP (for OTP, PLAIN, CHAP, etc.), AAA and RADIUS attributes.


- As Juergen Schoenwaelder pointed out, the implementors at that time 
did not want NETCONF/BEEP+TLS nor NETCONF/SOAP+HTTPS+TLS.


Best regards

--
Mohamad Badra
CNRS - LIMOS Laboratory



--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>