Subject: [NGO] FW: I-D ACTION:draft-cridlig-netconf-rbac-00.txt

From: "Romascanu, Dan \(Dan\)" <[email-masked]>
Date: Thu, 23 Nov 2006 14:08:38 +0200

I would encourage discussions on this draft on the ngo list. 

Dan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Thursday, November 16, 2006 10:50 PM
To: [email-masked]
Subject: I-D ACTION:draft-cridlig-netconf-rbac-00.txt 

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

	Title		: NETCONF access control framework
	Author(s)	: V. Cridlig
	Filename	: draft-cridlig-netconf-rbac-00.txt
	Pages		: 22
	Date		: 2006-11-16
	
   This document defines a role-based access control framework for the
   NETCONF configuration protocol.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-cridlig-netconf-rbac-00.txt

To remove yourself from the I-D Announcement list, send a message to 
[email-masked] with the word unsubscribe in the body of 
the message. 
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the 
username "anonymous" and a password of your e-mail address. After 
logging in, type "cd internet-drafts" and then 
"get draft-cridlig-netconf-rbac-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-cridlig-netconf-rbac-00.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail
readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

_______________________________________________
NGO mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ngo

---

From: Balazs Lengyel <[email-masked]>
Date: Fri, 24 Nov 2006 10:43:51 +0100

Hello,
I feel that the draft does not address a number of important questions:
- What kind of access types do we have ? Just read, write, notify ? Some have proposed 
create delete, others a marking like disturbs-traffic.
- What kind of access control will we have for actions like kill, lock, unlock ?
- How will we handle access control for actions in capabilities like ping, restart, backup 
? How do we know that a backup needs only read rights or if it needs write rights as well 
? For more exotic actions I feel we explicitly need to define what kind of access that 
action constitutes.

After that some proposed features are debatable
- the propagation of access rights down a sub-tree might suite some but might not suite others
- the dynamic activation of roles is an unusual concept for me but might be OK

regards Balazs

Romascanu, Dan (Dan) wrote:
> ------------------------------------------------------------------------
> 
> FILE DELETED
> ------------
> 
> Warning!
> 
> The attached file draft-cridlig-netconf-rbac-00.URL has not been delivered.
> The reason is due to that the filter FILE FILTER= unnamed: *.url is in effect.
> 
> 
> Ericsson Group IT
> 
> 
> ------------------------------------------------------------------------
> 
> I-D-Announce mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/i-d-announce
> 
> 
> ------------------------------------------------------------------------
> 

-- 
Balazs Lengyel                       Ericsson Hungary Ltd.
TSP System Manager
ECN: 831 7320                        Fax: +36 1 4377792
Tel: +36-1-437-7320     email: [email-masked]