Subject: Re: [OPSAWG] New Version Notification for draft-zheng-opsawg-tacacs-yang-01.txt

From: "Wubo (lana)" <[email-masked]>
Date: Mon, 18 Mar 2019 13:22:19 +0000

Hi, Alex

Thanks to the comments. Please see inline for the responses.

Thanks, 
Bo

-----邮件原件-----
发件人: Alex Campbell [mailto:[email-masked]] 
发送时间: 2019年3月18日 5:30
收件人: Alan DeKok <[email-masked]>; Wubo (lana) <[email-masked]>
抄送: [email-masked]
主题: Re: [OPSAWG] New Version Notification for draft-zheng-opsawg-tacacs-yang-01.txt

Are you sure about that? I don't see anything specific to TACACS+ in ietf-system-aaa.yang.

I did notice some issues and nits while reading the document:
* "accouting" should be spelled "accounting"
* "attribuets" should be spelled "attributes"
* TACACS should be TACACS+. TACACS is an older protocol which is not compatible with TACACS+.
[Bo] We will make the corrections in the next version.

* ietf-system already has a local-users identity. Are you proposing to deprecate this in favour of the one defined in ietf-system-aaa?
[Bo]  Yes, it is proposed to extend the local-users identity to support authorization and accounting as well. 

* I don't understand the purpose of /system/authorization/events and /system/accounting/events - even with the text in section 4.1 and 4.2.
[Bo] The events refers to the event generating authorization request or accounting-request.
        The tacacs+ protocol uses service attribute in section 8.2. Authorization Attributes to specify a request for authorization. For example: "shell", "tty-server", "connection", "system" and  "firewall". 
       It also uses event attribute in section 8.3.  Accounting Attributes to indicate commands or other system level changes.
      So the events node is proposed to describe the authorization or accounting types that AAA supports.

Regards, Alex
________________________________________
From: OPSAWG <[email-masked]> on behalf of Alan DeKok <[email-masked]>
Sent: Saturday, 16 March 2019 1:42 a.m.
To: Wubo (lana)
Cc: [email-masked]
Subject: Re: [OPSAWG] New Version Notification for draft-zheng-opsawg-tacacs-yang-01.txt

On Mar 15, 2019, at 4:48 AM, Wubo (lana) <[email-masked]> wrote:
>
> Dear WG,
>
> We uploaded the 01 version of draft-zheng-opsawg-tacacs-yang-01 to address some comments since last meeting.
> https://tools.ietf.org/html/draft-zheng-opsawg-tacacs-yang-01
>
> Here are some major changes in this version:
> -  Align the tacacs  YANG structure to system(RFC 7317) Radius client YANG naming.
> -  Change major tacacs properties to be configurable for each tacacs-server.
> - Add the authorization and accounting model as a system augmentation to support the full AAA configuration.

  Please don't refer to TACACS+ as an AAA protocol.  It's really not.  It's a management protocol, and doesn't do generic user AAA.

  Using "AAA" here is just confusing, IMHO.  e.g.:

   Additionally, to support full AAA feature, the "ietf-aaa" YANG module

  The document later refers to "ietf-aaa-tacacs", not "ietf-aaa".  I would strongly suggest changing the name of the model to "ietf-tacacs".

  Similarly:

   module: ietf-system-aaa

  Please change this to ietf-system-tacacs.

  I don't see it as at all useful to re-define "AAA" to mean "TACACS" here.  AAA has a well-defined meaning, which doesn't include TACACS.

  Alan DeKok.

_______________________________________________
OPSAWG mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsawg

---

From: "Wubo (lana)" <[email-masked]>
Date: Tue, 19 Mar 2019 08:35:27 +0000

Hi Alan,

Thanks for your comments, we will update the draft accordingly:
1. Add text to explain the model is limited to device management context, and remove "full AAA feature" text.
2. Change the tacacs+ client module name: "ietf-aaa-tacacs" -> "ietf-system-tacacs"
3. Add radius related accounting configuration.  

Thanks,
Bo

-----邮件原件-----
发件人: Alan DeKok [mailto:[email-masked]] 
发送时间: 2019年3月18日 22:26
收件人: Wubo (lana) <[email-masked]>
抄送: Alex Campbell <[email-masked]>; [email-masked]
主题: Re: [OPSAWG] New Version Notification for draft-zheng-opsawg-tacacs-yang-01.txt

On Mar 18, 2019, at 9:42 AM, Wubo (lana) <[email-masked]> wrote:
> Thanks for the guidance for this YANG draft.
> The draft only describes the tacacs+ device management configuration, and is not used for other purpose, such as network access. 

  Then it shouldn't define an AAA profile, and shouldn't use the term "AAA".

  The term "AAA" has a long history in the IETF of referring to network access protocols.  This document should not re-define AAA to mean "device management configuration".

  Please change the term "AAA" to something else.  Leaving it as "AAA" will only serve to confuse things.

> And for the system AAA extension, it is indeed could be extended to add radius as an accounting method also.  Your suggestions are welcome.

  I would have expected any device management model to include all relevant protocols, by default.  It's worrying that *only* TACACS+ was included.  Omitting everything else is just a sign that this is a TACACS+ document, and only a TACACS+ document.

  Alan DeKok.