Subject: [OPSAWG] TACACS++, please...

From: Warren Kumari <[email-masked]>
Date: Thu, 22 Apr 2021 11:08:59 -0400

Hi there all,

Last year we published "RFC8907 - The Terminal Access Controller
Access-Control System Plus (TACACS+) Protocol"

This was a huge amount of work, and we are hugely grateful to the authors
(and WG) for all of their hard work.... however, in the spirit of "no good
deed goes unpunished"...

When we wrote this, it was with the understanding that we'd first puslish
how TACACS+ currently works, and then a second document which, AFAIR, would
basically say "... and now just run this over TLS, K,  thanks, done".

I'm hoping that someone, probably the original RFC8907 authors, would be
willing to take this on?
I believe that this second document should be much much much easier....

So, RFC8907 authors, would you be willing to take this on? Please?

W

-- 
Perhaps they really do strive for incomprehensibility in their specs.
After all, when the liturgy was in Latin, the laity knew their place.
-- Michael Padlipsky

---

From: "Douglas Gash (dcmgash)" <[email-masked]>
Date: Thu, 22 Apr 2021 15:18:47 +0000

Hi Warren,

Yes, Thorsten, Andrej and I are actively engaged, and have been joined by a new team member (John Heasley).

There may be one or two minor other additions to enhance security that are also coming along for submission to the views of the WG.

From: Warren Kumari <[email-masked]>
Date: Thursday, 22 April 2021 at 16:09
To: opsawg <[email-masked]>, Thorsten Dahm <[email-masked]>, Andrej Ota <[email-masked]>, "Douglas Gash (dcmgash)" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: TACACS++, please...

Hi there all,

Last year we published "RFC8907 - The Terminal Access Controller Access-Control System Plus (TACACS+) Protocol"

This was a huge amount of work, and we are hugely grateful to the authors (and WG) for all of their hard work.... however, in the spirit of "no good deed goes unpunished"...

When we wrote this, it was with the understanding that we'd first puslish how TACACS+ currently works, and then a second document which, AFAIR, would basically say "... and now just run this over TLS, K,  thanks, done".

I'm hoping that someone, probably the original RFC8907 authors, would be willing to take this on?
I believe that this second document should be much much much easier....

W

---

From: Warren Kumari <[email-masked]>
Date: Thu, 22 Apr 2021 11:27:49 -0400

On Thu, Apr 22, 2021 at 11:18 AM Douglas Gash (dcmgash) <[email-masked]>
wrote:

> There may be one or two minor other additions to enhance security that are
> also coming along for submission to the views of the WG.
>

Just FYI, there are 459 people on the OpsAWG list; this means we have
almost 500 witnesses to what I'm going to interpret as "We'll have this
done in a few days/weeks" :-)

Seriously though, thank you. The TACACS YANG document was discussed
recently, and a bunch of ADs said "Oi! We largely approved the original
document on the understanding that you'd fix this. Pay up now..."

W

>
>
> *From: *Warren Kumari <[email-masked]>
> *Date: *Thursday, 22 April 2021 at 16:09
> *To: *opsawg <[email-masked]>, Thorsten Dahm <[email-masked]>,
> Andrej Ota <[email-masked]>, "Douglas Gash (dcmgash)" <[email-masked]>,
> "[email-masked]" <[email-masked]>, "[email-masked]" <
> [email-masked]>
> *Subject: *TACACS++, please...
>
>
>
> Hi there all,
>
>
>

-- 
The computing scientist’s main challenge is not to get confused by the
complexities of his own making.
  -- E. W. Dijkstra

---

From: tom petch <[email-masked]>
Date: Thu, 22 Apr 2021 15:33:41 +0000

From: OPSAWG <[email-masked]> on behalf of Warren Kumari <[email-masked]>
Sent: 22 April 2021 16:27

On Thu, Apr 22, 2021 at 11:18 AM Douglas Gash (dcmgash) <[email-masked]<mailto:[email-masked]>> wrote:
Hi Warren,

Just FYI, there are 459 people on the OpsAWG list; this means we have almost 500 witnesses to what I'm going to interpret as "We'll have this done in a few days/weeks" :-)

<tp>
Warren

I will believe it when I see it on the Milestones for the WG:-)

Tom Petch

Seriously though, thank you. The TACACS YANG document was discussed recently, and a bunch of ADs said "Oi! We largely approved the original document on the understanding that you'd fix this. Pay up now..."

W

From: Warren Kumari <[email-masked]<mailto:[email-masked]>>
Date: Thursday, 22 April 2021 at 16:09
To: opsawg <[email-masked]<mailto:[email-masked]>>, Thorsten Dahm <[email-masked]<mailto:[email-masked]>>, Andrej Ota <[email-masked]<mailto:[email-masked]>>, "Douglas Gash (dcmgash)" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: TACACS++, please...

Hi there all,

W

---

From: "Joe Clarke (jclarke)" <[email-masked]>
Date: Thu, 22 Apr 2021 16:02:59 +0000

Thanks for poking, Warren.  This is great to hear, Douglas.  Might I suggest a different name than TACACS++, though.  Maybe Objective TACACS :-P ?

Joe

On 4/22/21 11:19, Douglas Gash (dcmgash) wrote:
Hi Warren,

From: Warren Kumari <[email-masked]><mailto:[email-masked]>
Date: Thursday, 22 April 2021 at 16:09
To: opsawg <[email-masked]><mailto:[email-masked]>, Thorsten Dahm <[email-masked]><mailto:[email-masked]>, Andrej Ota <[email-masked]><mailto:[email-masked]>, "Douglas Gash (dcmgash)" <[email-masked]><mailto:[email-masked]>, "[email-masked]"<mailto:[email-masked]> <[email-masked]><mailto:[email-masked]>, "[email-masked]"<mailto:[email-masked]> <[email-masked]><mailto:[email-masked]>
Subject: TACACS++, please...

Hi there all,

W