Subject: [OPSAWG] John Scudder's No Objection on draft-ietf-opsawg-tacacs-yang-10: (with COMMENT)

From: John Scudder via Datatracker <[email-masked]>
Date: Tue, 20 Apr 2021 18:07:51 -0700

John Scudder has entered the following ballot position for
draft-ietf-opsawg-tacacs-yang-10: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-opsawg-tacacs-yang/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Below I've provided some small editorial suggestions in the form of a diff
against the plain text version of the draft. You may choose to incorporate them
in some way, or ignore them as you see fit. There is no need to let me know
what you did with these suggestions.

--- draft-ietf-opsawg-tacacs-yang-10.txt        2021-04-20 21:02:05.000000000
-0400 +++ draft-ietf-opsawg-tacacs-yang-10-jgs.txt    2021-04-20
21:04:01.000000000 -0400 @@ -151,7 +151,7 @@

 3.  Design of the TACACS+ Data Model

-   This module is used to configure TACACS+ client on a device to
+   This module is used to configure a TACACS+ client on a device to
    support deployment scenarios with centralized authentication,
    authorization, and accounting servers.  Authentication is used to
    validate a user's username and password, authorization allows the
@@ -160,7 +160,7 @@
    user who has accessed the device.

    The ietf-system-tacacs-plus module augments the "/sys:system" path
-   defined in the ietf-system module with the contents of the"tacacs-
+   defined in the ietf-system module with the contents of the "tacacs-
    plus" grouping.  Therefore, a device can use local, RADIUS, or

@@ -416,7 +416,7 @@
         type yang:counter64;
         description
           "Number of aborted connections to the server. These do
-           not include connections that are close gracefully.";
+           not include connections that are closed gracefully.";
       }
       leaf connection-failures {
         type yang:counter64;
@@ -528,7 +528,7 @@
               description
                 "The shared secret, which is known to both the
                  TACACS+ client and server. TACACS+ server
-                 administrators should configure shared secret of
+                 administrators should configure a shared secret of
                  minimum 16 characters length.
                  It is highly recommended that this shared secret is
                  at least 32 characters long and sufficiently complex
@@ -644,13 +644,13 @@

    /system/tacacsplus/server:  This list contains the data nodes used to
       control the TACACS+ servers used by the device.  Unauthorized
-      access to this list could cause a complete control over the device
+      access to this list could enable an attacker to assume complete control
over the device
       by pointing to a compromised TACACS+ server.

    /system/tacacsplus/server/shared-secret:  This leaf controls the key
       known to both the TACACS+ client and server.  Unauthorized access
       to this leaf could make the device vulnerable to attacks,
-      therefore has been restricted using the "default-deny-all" access
+      therefore it has been restricted using the "default-deny-all" access
       control defined in [RFC8341].  When setting, it is highly
       recommended that the leaf is at least 32 characters long and
       sufficiently complex with a mix of different character types i.e.

---

From: "Wubo (lana)" <[email-masked]>
Date: Thu, 22 Apr 2021 07:49:54 +0000

Hi John,

Thank you for the helpful comments. I will update accordingly.

Best regards,
Bo

-----邮件原件-----
发件人: John Scudder via Datatracker [mailto:[email-masked]] 
发送时间: 2021年4月21日 9:08
收件人: The IESG <[email-masked]>
抄送: [email-masked]; [email-masked]; [email-masked]; Joe Clarke <[email-masked]>; [email-masked]
主题: John Scudder's No Objection on draft-ietf-opsawg-tacacs-yang-10: (with COMMENT)

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

Below I've provided some small editorial suggestions in the form of a diff against the plain text version of the draft. You may choose to incorporate them in some way, or ignore them as you see fit. There is no need to let me know what you did with these suggestions.

    validate a user's username and password, authorization allows the @@ -160,7 +160,7 @@

@@ -416,7 +416,7 @@
         type yang:counter64;
         description
                  at least 32 characters long and sufficiently complex @@ -644,13 +644,13 @@

+      access to this list could enable an attacker to assume complete 
+ control

+      therefore it has been restricted using the "default-deny-all" 
+ access