[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: NETCONF over TLS
David B Harrington wrote:
1) key distribution is important; do more network nodes already
support TLS (and thus have certificates already distributed) or
already support SSH (and already have SSH-related credentials
distributed?
I think you have to start by asking who is trusting whom and for what?
Take for instance DOCSIS. Here the cable modems aren't really all that
trusted, and yet they receive a configuration. But they have to trust
the DOCSIS controller. If one uses NETCONF over BEEP in this way, then
the clients don't need to log in at all, but they assuredly want some
reason to trust their configuration server. TLS and the X.509
infrastructure is well suited for this, as it is fairly easy to
configure a small number of DNs that are signed by well known CAs that
can be trusted. And so to answer your question, certainly the CAs are
more well known than SSH will key pairs will ever be. That leaves the
configuring of which DN you want to trust.
Oh and for good measure, a manufacturers cert could be demanded for
*some* sort of authentication.
2) Will netconf provide application-level security beyond what the
secure transport provides, such as data access controls? If so, will
this be easier using TLS or SSH? What attributes need to be passed up
from the transport security to the application to provide these extra
services?
I think an example of what you have in mind would help. I don't
immediately see relevance between the difference in secure transport and
what happens above it.
3) Which is easier to integrate with AAA protocols, such as RADIUS and
Diameter?
This is where BEEP does its thing. You do both TLS *and* SASL, and
voila: you can mix and match, even, based on deployment needs.
4) and most important, what would the operators use if both SSH and
TLS were
available?
Operators need to answer this question.
My recommendation is to ask Badra to publish the draft as
experimental, and ask Badra to find other people willing to implement
Netconf/TLS as part of the experiment.
I would first like to understand from Badra why TLS+SASL/BEEP is not
sufficient?
Eliot
--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>