Subject: [yang-doctors] security boilerplate for RESTCONF

From: Andy Bierman <[email-masked]>
Date: Wed, 10 Aug 2016 16:24:17 -0700

Hi,

The boilerplate for YANG modules SC section is for NETCONF only:

12.  Security Considerations

   The "ietf-restconf-monitoring" YANG module defined in this memo is
   designed to be accessed via the NETCONF protocol [RFC6241].  The
   lowest NETCONF layer is the secure transport layer, and the
   mandatory-to-implement secure transport is Secure Shell (SSH)
   [RFC6242].  The NETCONF access control model [RFC6536] provides the
   means to restrict access for particular NETCONF users to a pre-
   configured subset of all available NETCONF protocol operations and
   content.

It does seem odd that the RESTCONF SC section talks about NETCONF
and not RESTCONF

Dale suggested this text for RESTCONF:

   The lowest RESTCONF layer is HTTPS, and the mandatory to implement
   secure transport is TLS [RFC5246].  The RESTCONF protocol uses the
   NETCONF access control model [RFC6536], which provides the means to
   restrict access for particular RESTCONF users to a pre-configured
   subset of all available RESTCONF protocol operations and content.

Any suggestions for new SC template text so NETCONF and RESTCONF are
both covered?

Andy

---

From: Mahesh Jethanandani <[email-masked]>
Date: Wed, 10 Aug 2016 17:07:47 -0700

Andy,

> On Aug 10, 2016, at 4:24 PM, Andy Bierman <[email-masked]> wrote:
> 
> Hi,
> 

s/mandatory to implement/mandatory-to-implement/

> Any suggestions for new SC template text so NETCONF and RESTCONF are

Isn't this for RESTCONF draft?

> 
> 
> Andy
> 
> _______________________________________________
> yang-doctors mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/yang-doctors

Mahesh Jethanandani
[email-masked]

---

From: Andy Bierman <[email-masked]>
Date: Wed, 10 Aug 2016 17:11:56 -0700

> s/mandatory to implement/mandatory-to-implement/
cut-and-paste changed that.  It was correct in Dale's comments

> Isn't this for RESTCONF draft?

Well once RESTCONF is published then presumably each YANG module
(like ietf-routing) needs boilerplate text

https://trac.tools.ietf.org/area/ops/trac/wiki/yang-security-guidelines

This is the text that needs updating when RESTCONF is published.

Andy

---

From: Mahesh Jethanandani <[email-masked]>
Date: Wed, 10 Aug 2016 18:02:27 -0700

> On Aug 10, 2016, at 5:11 PM, Andy Bierman <[email-masked]> wrote:
> 
> 
> 
> On Wed, Aug 10, 2016 at 5:07 PM, Mahesh Jethanandani <[email-masked] <mailto:[email-masked]>> wrote:
> Andy,
> 
> > On Aug 10, 2016, at 4:24 PM, Andy Bierman <[email-masked] <mailto:[email-masked]>> wrote:
> >
> > Hi,
> >
> https://trac.tools.ietf.org/area/ops/trac/wiki/yang-security-guidelines <https://trac.tools.ietf.org/area/ops/trac/wiki/yang-security-guidelines>
> 
> 

Ok. So there are two asks. One for RESTCONF which to me looks ok and one for the boilerplate.

How about this for the boilerplate?

            OLD
The YANG module defined in this memo is designed to be accessed via the NETCONF protocol [RFC6241]. The lowest NETCONF layer is the secure transport layer, and the mandatory-to-implement secure transport is Secure Shell (SSH) [RFC6242]. The NETCONF access control model [RFC6536] provides the means to restrict access for particular NETCONF users to a pre-configured subset of all available NETCONF protocol operations and content.

NEW

The YANG module defined in this memo is designed to be accessed via the NETCONF [RFC6241] or RESTCONF [RFCXXXX] protocol. The lowest NETCONF layer is the secure transport layer, and mandatory-to-implement is Secure Shell (SSH) [RFC6242], while the lowest RESTCONF layer is HTTP, and the mandatory-to-implement secure transport is Transport Layer Security (TLS) [RFC5246]. 
The NETCONF access control model [RFC6536] provides the means to restrict access for particular NETCONF or RESTCONF users to a pre-configured subset of all available NETCONF or RESTCONF protocol operations and content.
> > [email-masked] <mailto:[email-masked]>
> > https://www.ietf.org/mailman/listinfo/yang-doctors <https://www.ietf.org/mailman/listinfo/yang-doctors>
> 
> Mahesh Jethanandani
> [email-masked] <mailto:[email-masked]>
Mahesh Jethanandani
[email-masked]

---

From: Ladislav Lhotka <[email-masked]>
Date: Thu, 11 Aug 2016 09:32:09 +0200

> Any suggestions for new SC template text so NETCONF and RESTCONF are

I have this for the next revision of the routing draft:

   Configuration and state data conforming to the core routing data
   model (defined in this document) are designed to be accessed via a
   management protocol with secure transport layer, such as NETCONF
   [RFC6241].  The NETCONF access control model [RFC6536] provides the
   means to restrict access for particular NETCONF users to a pre-
   configured subset of all available NETCONF protocol operations and
   content.

It would be great to have protocol-agnostic NACM.

Lada

-- 
Ladislav Lhotka, CZ.NIC Labs
PGP Key ID: E74E8C0C

---

From: Mahesh Jethanandani <[email-masked]>
Date: Thu, 11 Aug 2016 09:37:05 -0700

> On Aug 11, 2016, at 12:32 AM, Ladislav Lhotka <[email-masked]> wrote:
> 

Could the last sentence be made protocol agnostic? Something like:

The NETCONF access control model [RFC6536] provides the means to restrict access to particular users to a preconfigured subset of all available management protocol operations and content.