Subject: New core drafts - was: Re: nit in draft-ietf-secsh-connect-25.txt

From: Chris Lonvick <[email-masked]>
Date: Wed, 7 Sep 2005 11:10:54 -0700 (PDT)

Hi,

I've updated the drafts to get all of the messages indented the same way. 
I also found that there were some occurances of "recipient_channel" but 
more of "recipient channel" (mostly in CONNECT) so I harmonized them.

The new set of IDs are here:
   http://www.employees.org/~lonvick/secsh-wg/2005-sep-07/
Please look them over.  If no one finds any problems then I'll let the RFC 
Editor know that a few more non-substantiative fixes were made and that 
they can use these drafts to create the RFCs.

Thanks,
Chris

On Sun, 14 Aug 2005, Anil Madhavapeddy wrote:

> In Section 6.10 (Returning Exit Status) of draft-ietf-secsh-connect-25.txt,
> the formatting of the "exit-signal" packet is different from the
> rest and indented incorrectly.  Breaks my spec-extraction regexp,
> hence the motivation to point it out :)
> 
> -- 
> Anil Madhavapeddy                                 http://anil.recoil.org
> University of Cambridge                          http://www.cl.cam.ac.uk
>

---

From: "Tom Petch" <[email-masked]>
Date: Thu, 8 Sep 2005 15:39:18 +0200

I see, belatedly, that secsh-arch still has a reference to SNMP and proxy
forwarding in it.

Since isms has now chosen to pursue SNMP over SSH and since proxy forwarding is
a significant feature of SNMP and since, as far as I can establish, the
reference in secsh-arch has no relationship to any of this whatsoever, I think
that 'SNMP' should be elided from the document before it spreads havoc and
confusion (already widespread in and around isms:-(

Tom Petch

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 08 Sep 2005 11:07:58 -0400

On Thursday, September 08, 2005 15:39:18 +0200 Tom Petch 
<[email-masked]> wrote:

> Since isms has now chosen to pursue SNMP over SSH and since proxy
> forwarding is a significant feature of SNMP and since, as far as I can
> establish, the reference in secsh-arch has no relationship to any of this
> whatsoever, I think that 'SNMP' should be elided from the document before
> it spreads havoc and confusion (already widespread in and around isms:-(

Given that the SNMP-over-SSH work being done in ISMS currently takes the 
form of a subsystem rather than a connection-forwarding channel, I'm 
inclined to agree.  Removing the mention of SNMP as an example does not 
meaningfully change the document, but will likely avoid considerable 
confusion in the future.

-- Jeff

---

From: Chris Lonvick <[email-masked]>
Date: Thu, 8 Sep 2005 09:07:28 -0700 (PDT)

Hi,

Current in Section 9.5.2  Proxy Forwarding
    The SSH connection protocol allows for proxy forwarding of other
    protocols such as SNMP, POP3, and HTTP.  This may be a concern for
    network administrators who wish to control the access of certain
    ...

Proposed
    The SSH connection protocol allows for proxy forwarding of other
    protocols such as POP3, and HTTP.  This may be a concern for
    network administrators who wish to control the access of certain
    applications by users located outside of their physical location.
    Essentially, the forwarding of these protocols may violate site
    specific security policies as they may be undetectably tunneled
    through a firewall.  Implementors SHOULD provide an administrative
    mechanism to control the proxy forwarding functionality so that site
    specific security policies may be upheld.

If no one objects to this minor change then I'll let the RFC Editor know 
to use this update.

Thanks,
Chris

On Thu, 8 Sep 2005, Jeffrey Hutzelman wrote:

> Given that the SNMP-over-SSH work being done in ISMS currently takes the form 
> of a subsystem rather than a connection-forwarding channel, I'm inclined to 
> agree.  Removing the mention of SNMP as an example does not meaningfully 
> change the document, but will likely avoid considerable confusion in the 
> future.
>
> -- Jeff
>

---

From: Bill Sommerfeld <[email-masked]>
Date: Thu, 08 Sep 2005 12:12:15 -0400

>     network administrators who wish to control the access of certain

Actually, I would suggest changing "SNMP" to "SMTP".  

SNMP makes no sense there since we don't have a UDP forwarding
capability in the specs at present.

Dunno about anyone else but I started doing SMTP-over-SSH forwarding on
a routine basis from my laptop years ago.

						- Bill

---

From: Chris Lonvick <[email-masked]>
Date: Thu, 8 Sep 2005 09:44:30 -0700 (PDT)

Hi,

> Actually, I would suggest changing "SNMP" to "SMTP".

That makes sense.  I've updated ARCH to reflect that.
   http://www.employees.org/~lonvick/secsh-wg/2005-sep-07/

> a routine basis from my laptop years ago.

I use pine.  (...over ssh)

Thanks,
Chris

---

From: der Mouse <[email-masked]>
Date: Thu, 8 Sep 2005 13:02:46 -0400 (EDT)

> Proposed [...]

I too think it'd be better to just s/SNMP/SMTP/.  But if you want to
delete SNMP, the comma after POP3 should go too.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: "Tom Petch" <[email-masked]>
Date: Thu, 8 Sep 2005 19:25:31 +0200

Yes, SMTP sounds like an excellent suggestion.

Tom Petch
----- Original Message -----
From: "Chris Lonvick" <[email-masked]>
To: "Bill Sommerfeld" <[email-masked]>
Cc: "Jeffrey Hutzelman" <[email-masked]>; "Tom Petch"
<[email-masked]>; <[email-masked]>
Sent: Thursday, September 08, 2005 6:44 PM
Subject: Re: New core drafts - was: Re: nit in draft-ietf-secsh-connect-25.txt