Subject: [Isms] Review of draft-ietf-isms-secshell-13

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Tue, 25 Nov 2008 18:26:43 -0800

Here are some review comments on draft-ietf-isms-secshell-13:

1. (editorial) 3.1.2 the first sentence in the third paragraph is a
duplicate of one in the preceding paragraph.  I suggest removing it. 

2. 3.1.2 - In paragraph 2 I don't think we need the text after the first
2 sentences.  This would better belong in a AAA document

3. 4.3.1 - In some cases the user name field of the
SSH_MSG_USERAUTH_REQUEST may not be validated by the SSH server.  In
these cases it should not be relied upon as an authenticated identity.
This section needs to take this into account. Here is some text for the
second paragraph of the SSH server side of a connection:

      The SSH protocol is not always clear on whether the user name
      field must be filled in, so for some implementations, such as
      those using GSSAPI authentication, it may be necessary to use a
      mapping algorithm to transform a user name to a SSH identity
      compatible with the parameters required by this transport. In 
      other cases the user name may not be verified by the server, 
      so for these implementations, it may be necessary to obtain the 
      user name from other credentials exchanged during the SSH
exchange. 
      How a compatible SSH identity is determined should be 
      administratively configurable if such a mapping is needed.

4. in section 5.1 

1, second paragraph should contain a pointer to the issues in 4.3.1 
2, tmSecurityName shouldn't this just be "ssh principal name determined
by the SSH server."?

5. Its not clear to me from the elements of procedure how access control
is performed for a notification originator. On a notification originator
when is access control performed, what principal name is used and where
does it come from?  I concerned that currently it will use a local
principal instead of the remote principal which does not seem right.  

_______________________________________________
Isms mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/isms