Subject: Re: [OPSAWG] New Version Notification for draft-zheng-opsawg-tacacs-yang-01.txt

From: "Wubo (lana)" <[email-masked]>
Date: Mon, 18 Mar 2019 13:42:39 +0000

Hi Alan,

Thanks for the guidance for this YANG draft.
The draft only describes the tacacs+ device management configuration, and is not used for other purpose, such as network access. 

And for the system AAA extension, it is indeed could be extended to add radius as an accounting method also.  Your suggestions are welcome.

Thanks,
Bo

-----邮件原件-----
发件人: Alan DeKok [mailto:[email-masked]] 
发送时间: 2019年3月18日 6:17
收件人: Alex Campbell <[email-masked]>
抄送: Wubo (lana) <[email-masked]>; [email-masked]
主题: Re: [OPSAWG] New Version Notification for draft-zheng-opsawg-tacacs-yang-01.txt

On Mar 17, 2019, at 5:30 PM, Alex Campbell <[email-masked]> wrote:
> 
> Are you sure about that? I don't see anything specific to TACACS+ in ietf-system-aaa.yang.

  That's not the point.

  Is this a TACACS+ YANG model, or is this a AAA YANG model?

  If it's a AAA YANG data model, then there are already two AAA working groups which haven't been consulted about this work. The aaa-doctors group hasn't been consulted, either.  There are still people working in this space who might have input here.

  There is already a RADIUS YANG module, which seems relevant.  It was done without consulting the RADEXT WG, either, or the aaa-doctors list.  It also doesn't match RFC 5080 for retransmissions, and doesn't allow for non-UDP transports, despite RFC 6613 (TCP), RFC 6614 (TLS), and RFC 7630 (DTLS).  But that's a separate point.

  IMHO, this document should focus on the TACACS+ needs, and define a YANG data model for TACACS+.  It should *not* define a generic AAA YANG data model.   It should *especially* not define a generic IETF AAA YANG data model in a document that's mixed up with a non-AAA protocol.

  As for "nothing specific to TACACS+", please see the text in the abstract:

   The data model of Terminal Access Controller
   Access Control System Plus (TACACS+) client allows the configuration
   of TACACS+ servers for centralized Authentication, Authorization and
   Accouting. 

  TACACS+ is not an AAA protocol.  We're had this discussion going back years.

  If we look at the document further, we see:

...
4.  AAA Model Augmentation

   This document augments the system model with authorization model and
   accouting model to support full AAA feature.
...

  So it's not augmenting the AAA model as the title suggests.  It's adding an entirely new AAA model to the ietf-system model.  So that's confusing.

  It continues with the next paragraph:

...
   For the authentication model, if the NETCONF server advertises the
   "tacacs" feature, the device also supports user authentication using
   TACACSPLUS.  For NETCONF transport protocols that support password
   authentication, the leaf-list "user-authentication-order" is used to
   control if TACACSPLUS password authentication should be used.
...

  So the only *example*  of the ietf-aaa model is TACACS+.  The document continues with:

...
   For the authorization model and accouting model, the extended AAA
   data model has the following structure:
...

  OK, so there's nothing *specifically* about TACACS+ in the YANG diagram.  That part is at least true.

  But to address your first sentence quoted way above, the next section is:

...
4.1.  User Authorization Model

   Following authentication, a user must gain authorization for doing
   certain tasks.  For instance, the user may try to issue commands.
   The authorization process determines whether the user has the
   authority to issue such commands.

   This document defines two optional authorization YANG features:
   "local-users" and "tacacs",
...

  Which entirely contradicts the claim that there's nothing TACACS+ specific in the model.

  In fact, the model *explicitly discusses* "ietf-aaa" as being (a) local users, or (b) TACACS+.  There are *zero* provisions for the the model more generic, e.g. to include RADIUS.

  I don't even know why we're having this argument.  The document is absolutely clear that "ietf-aaa" is for TACACS+, and not for any of the *actual* AAA protocols that we've been using for 30 years.  The document goes so far as to omit those other protocols entirely from consideration.

  Again, if this document is for TACACS+, it should define a TACACS+ YANG model and let it be.  If there's a need for a more generic ietf-system-aaa YANG model, then perhaps we should discuss that with the AAA people.  And if we want to really push the envelope, provide for those AAA protocols in the ietf-system-aaa YANG model.

  Alan DeKok.

---

From: Alan DeKok <[email-masked]>
Date: Mon, 18 Mar 2019 10:25:51 -0400

> The draft only describes the tacacs+ device management configuration, and is not used for other purpose, such as network access. 

  Then it shouldn't define an AAA profile, and shouldn't use the term "AAA".

  The term "AAA" has a long history in the IETF of referring to network access protocols.  This document should not re-define AAA to mean "device management configuration".

  Please change the term "AAA" to something else.  Leaving it as "AAA" will only serve to confuse things.

> And for the system AAA extension, it is indeed could be extended to add radius as an accounting method also.  Your suggestions are welcome.

  I would have expected any device management model to include all relevant protocols, by default.  It's worrying that *only* TACACS+ was included.  Omitting everything else is just a sign that this is a TACACS+ document, and only a TACACS+ document.

  Alan DeKok.