Subject: [OPSAWG] WG LC: draft-ietf-opsawg-tacacs-yang-03

From: "Joe Clarke (jclarke)" <[email-masked]>
Date: Mon, 20 Apr 2020 13:23:13 +0000

Hello, opsawg.  As we stated in the April 7 virtual interim, this draft has reached a point where current WG feedback has been incorporated, and the larger TACACS+ is progressing through the IESG.  We are opening a two week last call for this draft.

Please comment as to whether or not you feel it is ready and what additional changes are required by May 3, 2020.

Thanks.

Joe and Tianran

Joe

---

From: "Joe Clarke (jclarke)" <[email-masked]>
Date: Mon, 20 Apr 2020 13:26:07 +0000

Hello, authors.  Tianran and I were chatting over email, and he had a good suggestion.  Could you add an example to this draft showing off how to use the model?

Joe

> On Apr 20, 2020, at 09:23, Joe Clarke (jclarke) <jclarke=[email-masked]> wrote:
> 
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg

---

From: tom petch <[email-masked]>
Date: Tue, 21 Apr 2020 09:08:55 +0000

I think that more is needed for security.

Security Considerations does not list any sensitive nodes.  I see 'secret' as an obvious candidate with its nacm:deny-all and perhaps the list of servers and their addresses.

The model allows for accounting or authorisation or authentication or all three but not two out of three; I do not know if this is a use case.

opsawg-tacacs says secret must be 16  preferably 32; YANG can enforce the former and recommend the latter

server name is unrestricted in length or character set; is this desirable (YANG has a type for identifiers limited to the usual A-Z 0-9 plus some punctuation)?

Overall I was expecting more but that said I cannot think of what to add!

Tom Petch

________________________________________
From: OPSAWG <[email-masked]> on behalf of Joe Clarke (jclarke) <jclarke=[email-masked]>
Sent: 20 April 2020 14:23
To: opsawg
Subject: [OPSAWG] WG LC: draft-ietf-opsawg-tacacs-yang-03

Thanks.

Joe and Tianran

Joe