Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor

2018-07-13 Thread Douglas Gash (dcmgash)
Dear Alan, Do the changes below clarify the intent sufficiently? (please find diff below) The changes are mainly in first section with a few tweaks in later sections. Many thanks. 9.5 Deployment Best Practices With respect to the observations about the security issues described above, a  netw

Re: [OPSAWG] IETF102: Submit your slides

2018-07-13 Thread Tianran Zhou
It is also encouraged that the authours could send your slides earlier. So that people can preview and make comments. Cheers, Tianran Sent from WeLink 发件人: Joe Clarke 收件人: opsawgmailto:opsawg@ietf.org>> 主题: [OPSAWG] IETF102: Submit your slides 时间: 2018-07-12

Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor

2018-07-13 Thread joel jaeggli
On 7/13/18 4:30 AM, Alan DeKok wrote: > There have been many, many, historical protocols documented in the IETF. > None that I recall have a statement explicitly blessing existing > implementations. > > The document *should* say that it documents TACACS+ as per existing > implementatio

Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor

2018-07-13 Thread Alan DeKok
On Jul 13, 2018, at 11:39 AM, Randy Bush wrote: >> >> Also, we have *no idea* if the document matches current implementations or >> deployments. The proponents of TACACS+ have been surprisingly silent on >> this topic. > > i am missig the example of where it does not. There are probably d

Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor

2018-07-13 Thread Randy Bush
> There are still unaddressed comments. Do we do WG last calls for > unfinished documents? > > Also, we have *no idea* if the document matches current implementations or > deployments. The proponents of TACACS+ have been surprisingly silent on this > topic. > > So everyone wants the do

Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor

2018-07-13 Thread Alan DeKok
On Jul 13, 2018, at 11:30 AM, Joe Clarke wrote: > > I am hoping to start a WGLC at the Tuesday meeting, and cary it over to > the list to make it official. There are still unaddressed comments. Do we do WG last calls for unfinished documents? Also, we have *no idea* if the document matche

Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor

2018-07-13 Thread Randy Bush
>>> I think the current proposals are pretty close, at least from my end. >>> I think it's just word smithing from now on. >> >> good. so it should be fiished by the time the drafts door re-opens on >> monday? > > I am hoping to start a WGLC at the Tuesday meeting, and cary it over to > the list

Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor

2018-07-13 Thread Joe Clarke
On 7/13/18 10:37, Randy Bush wrote: >> I think the current proposals are pretty close, at least from my end. >> I think it's just word smithing from now on. > > good. so it should be fiished by the time the drafts door re-opens on > monday? I am hoping to start a WGLC at the Tuesday meeting, and

Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor

2018-07-13 Thread Randy Bush
> I think the current proposals are pretty close, at least from my end. > I think it's just word smithing from now on. good. so it should be fiished by the time the drafts door re-opens on monday? randy ___ OPSAWG mailing list OPSAWG@ietf.org https://

Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor

2018-07-13 Thread Alan DeKok
On Jul 13, 2018, at 10:29 AM, Randy Bush wrote: > i do not think we are gonna 'fix' the security model. this is a widely > deployed antique we are just trying to document so new victims can > interoperate. That has been the goal all along. Along with the goal of documenting security issues.

Re: [OPSAWG] Review of li-opsawg-address-pool-management-arch-01

2018-07-13 Thread xiechf....@chinatelecom.cn
Hi, You Lu, Thank you for your review and comments. pls see my comments inline. Chongfeng xiechf@chinatelecom.cn From: You Lu Date: 2018-07-13 14:46 To: opsawg Subject: [OPSAWG] Review of li-opsawg-address-pool-management-arch-01 Hi OPSAWG, I have read li-opsawg-address-pool-management

Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor

2018-07-13 Thread Randy Bush
as one of the many folk who have been using this protocol since the '90s, i gotta wonder how many angels we can sit on the head of this bikeshed. i do not think we are gonna 'fix' the security model. this is a widely deployed antique we are just trying to document so new victims can interoperate.

Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor

2018-07-13 Thread Douglas Gash (dcmgash)
Thanks Alan... > On 13 Jul 2018, at 14:30, Alan DeKok wrote: > >> On Jul 13, 2018, at 1:00 AM, Douglas Gash (dcmgash) >> wrote: >> 9.5 Deployment Best Practices >> >> With respect to the observations about the security issues described above, >> a network administrator MUST NOT rely on the o

Re: [OPSAWG] TACACS+ information Draft Security Recommendations refactor

2018-07-13 Thread Alan DeKok
On Jul 13, 2018, at 1:00 AM, Douglas Gash (dcmgash) wrote: > 9.5 Deployment Best Practices > > With respect to the observations about the security issues described above, a > network administrator MUST NOT rely on the obfuscation of the TACACS+ > protocol and TACACS+ MUST be deployed over netwo