partial lock security concerns

[Andy Bierman <ietf@andybierman.com>]

Hi,

I am somewhat concerned about the security vulnerabilities
created by a partial-lock solution based on arbitrary Xpath expressions.
I assure you that the Security Area Director will be even more
concerned, once he hears about it.

Granting access at the time the Xpath expression is configured,
instead of when access is requested is not good enough security.

Even if the Xpath expression was checked at access request time,
there are still problems.

Consider the possibility that the Xpath expression allows more
nodes that the intended set to be accessed, under spurious conditions.
The operator who wrote the Xpath expression is not aware this hole exists.

Consider the possibility that a hacker knows the security configuration,
and knows when and how to take advantage of the 'extra access'.

The only safe solution is to base the locks on stable information,
which cannot be edited under any circumstances by a user.
Only the 'naming' information (QName path from root) meets this
requirement.


Andy


--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>