Subject: Re: [netmod] trim vs. NACM [WAS: draft-ietf-netmod-routing-cfg-14.txt (review of changes)]

From: Randy Presuhn <[email-masked]>
Date: Sun, 25 May 2014 18:55:58 -0700 (GMT-07:00)

Hi -

>From: Ladislav Lhotka <[email-masked]>
>Sent: May 25, 2014 11:24 AM
>To: Andy Bierman <[email-masked]>
>Cc: "[email-masked]" <[email-masked]>
>Subject: Re: [netmod] trim vs. NACM [WAS: draft-ietf-netmod-routing-cfg-14.txt (review of changes)]
...
>I understand that firewalls use DROP rather than REJECT in
>order to avoid DoS attacks. For NACM, it doesn't make much
>sense to me because the client already has an open session
>and must have authenticated himself to the server. In
>filesystems and on the web, "access denied" replies are normal. 

The concern isn't about mitigating DoS.

The concern is that "access denied" leaks information.
For example, it could allow a relatively unprivileged
person to discover whether a system is used by a target,
whether a system has vulnerable hardware or software
installed on it, or whether high-value information is
present that would warrant a physical or social engineering
attack.  The authentication of a user doesn't mean they
can be completely trusted; it only means they should be
trusted no more than their access permissions allow.

Even in the case of HTTP, RFC 2616 section 10.4.4 on
"403 Forbidden" specifies that "[i]f the server does
not wish to make this information available to the client,
the status code 404 (Not Found) can be used instead."
That's also the motivation for disabling directory
listings on websites.

Randy

---

From: Ladislav Lhotka <[email-masked]>
Date: Mon, 26 May 2014 06:35:58 +0200

> trusted no more than their access permissions allow.

I still don't get it. The client had received the server's hello message so he knows the complete data model. Then, in my view, not receiving a node (subtree) is semantically equivalent to receiving it with the contents of <no-access/>.

In your example, a client could receive something like

<sys:platform>
  <nacm:no-access/>
</sys:platform>

I don't see how this helps an attacker compared to the case when <sys:platform> is not present.

> That's also the motivation for disabling directory

This doesn't work for NETCONF/YANG exactly because the server reveals its full data model. It would make sense only if the server could suppress advertising parts of the data model or features.

Lada

>
> Randy
>
> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod

-- 
Ladislav Lhotka, CZ.NIC Labs
PGP Key ID: E74E8C0C