Subject: Re: [netmod] I-D Action: draft-ietf-netmod-system-mgmt-11.txt

From: "Yi Yang (yiya)" <[email-masked]>
Date: Wed, 5 Feb 2014 19:05:30 +0000

I have a quick question on authentication method.

If the system supports SSH public key authentication only, but not local
user password, how user-authentication-order should be set?

Yi

On 1/20/14 7:06 AM, "[email-masked]" <[email-masked]>
wrote:

>
>A New Internet-Draft is available from the on-line Internet-Drafts
>directories.
> This draft is a work item of the NETCONF Data Modeling Language Working
>Group of the IETF.
>
>        Title           : A YANG Data Model for System Management
>        Authors         : Andy Bierman
>                          Martin Bjorklund
>	Filename        : draft-ietf-netmod-system-mgmt-11.txt
>	Pages           : 39
>	Date            : 2014-01-20
>
>Abstract:
>   This document defines a YANG data model for the configuration and
>   identification of some common system properties within a device
>   containing a NETCONF server.  This includes data node definitions for
>   system identification, time-of-day management, user management, DNS
>   resolver configuration, and some protocol operations for system
>   management.
>
>
>The IETF datatracker status page for this draft is:
>https://datatracker.ietf.org/doc/draft-ietf-netmod-system-mgmt/
>
>There's also a htmlized version available at:
>http://tools.ietf.org/html/draft-ietf-netmod-system-mgmt-11
>
>A diff from the previous version is available at:
>http://www.ietf.org/rfcdiff?url2=draft-ietf-netmod-system-mgmt-11
>
>
>Please note that it may take a couple of minutes from the time of
>submission
>until the htmlized version and diff are available at tools.ietf.org.
>
>Internet-Drafts are also available by anonymous FTP at:
>ftp://ftp.ietf.org/internet-drafts/
>
>_______________________________________________
>netmod mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/netmod

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 6 Feb 2014 11:39:17 +0100

> user password, how user-authentication-order should be set?
 
I think this is fair question to ask. Martin and Andy, are we missing
an identity for this case?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 06 Feb 2014 12:59:14 +0100 (CET)

> an identity for this case?

The local-users feature handles SSH keys as well, see 3.5.1.  As
explained in 3.5.1, ssh public key authentication is requested by the
client, so the authentication-order on the server doesn't really
apply.

/martin

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 6 Feb 2014 14:45:18 +0100

> client, so the authentication-order on the server doesn't really

Martin,

we are talking about the case where you disable password and
key-interactive authentication on the server side. This is actually
how I run the machines I am reponsible for (so I can sleep well
despite all the SSH login scanners out there).

/js

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 06 Feb 2014 15:05:24 +0100 (CET)

> despite all the SSH login scanners out there).

Ok, but it doesn't make much sense to control this with
user-authentication-order.  The reason for this is that it is unclear
what this means:

  user-authentication-order: radius, ssh-key

First radius, then ssh-key?  It doesn't make much sense.

Actually, this can be achieved today if you set
user-authentication-order to the empty list.

/martin

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 6 Feb 2014 16:25:05 +0100

> user-authentication-order to the empty list.

OK, fine with me (after reading the text again).

I guess the confusion comes from 'user-authentication-order' which is
really 'user-password-authentication-order' (and no, I do not suggest
this longish name). 

But perhaps this can be clarified? Eg. by stating explicitly:

    An empty user-authentication-order list still allows
    authentication of users using mechanisms that do not involve a
    password.

/js

---

From: "Yi Yang (yiya)" <[email-masked]>
Date: Thu, 6 Feb 2014 19:45:28 +0000

Hi Martin,

One issue is for "feature local-users", as specified in section 3.5.1 and
3.5.2, it indicates support of public-key-based AND password-based
authentication for local users. But what if only public-key-based is
supported, or vice versa? How would client discover it?

Yi

---

From: "Yi Yang (yiya)" <[email-masked]>
Date: Thu, 6 Feb 2014 19:50:31 +0000

Please see my comments inline with [yi]:

>really 'user-password-authentication-order' (and no, I do not suggest

[yi]: How about "password-authentication-order" or simply "password-order"?

>    authentication of users using mechanisms that do not involve a

[yi]: Only when public-key based approach is supported. In other words, if
public-key based approach is not supported, an empty
"*-authentication-order" list should not be allowed.

Yi

---

From: Martin Bjorklund <[email-masked]>
Date: Thu, 06 Feb 2014 21:58:22 +0100 (CET)

Hi,

> supported, or vice versa? How would client discover it?

public-key is mandatory to support according to RFC 4252, so it makes
sense to not have a special feature for it.

I don't think it's common with systems that don't support passwords;
of course the operator can choose to not use them, as already haas
been stated.

/martin

---

From: "Yi Yang (yiya)" <[email-masked]>
Date: Thu, 6 Feb 2014 21:16:12 +0000

Hi Martin,

Now I see why we don¹t need something explicitly for public-key. And
"user-authentication-order" is really for password-based only.

Yi

---

From: Martin Bjorklund <[email-masked]>
Date: Fri, 07 Feb 2014 08:20:27 +0100 (CET)

>     authentication of users using mechanisms that do not involve a

This is fine.  I have added this clarification.

/martin