Re: draft-jones-opsec-01.txt comments: in-band management

[George Jones <gmj@pobox.com>]

On Wed, 22 Oct 2003, Joel N. Weber II wrote:

> I wonder if it would make sense to explicitly mandate specific
> encryption protocols for in-band management protocols.  For example,
> for devices that support an in-band CLI, we could require sshv2.
> There's a specific IETF-standardized secure syslog protocol, and
> perhaps devices should be required to implement that.

So, the approach I've been taking is to make the requirement
generic "secure in band management" with the example citing
one or more current technologies/praticies as as SUGGESTIONS
of ways to meet the requirement.   The idea is that SSH
or IPsec or RADIUS/DIAMETER/KERBEROS may not be best
way to implement FOO 5 years from now and we want the
requirement (but probably not the implementation) to
age as gracefully as possible.

If people have suggestions for ways to tie the current
implementations more strongly to the requirements
without precuding better implemetaionts later, I'm all for
it.

I'd love to say "SSH, no telnet", "SNMPv3, no SNMPv1",
"SCP/SFTP, no TTP".

[more later...gotta go...looks like I may be editing past Friday
at this rate]

Thanks,
----George