Re: Last Call: 'NETCONF Configuration Protocol' to Proposed Standard

[Sam Hartman <hartmans-ietf at mit.edu>]

Hi.  This is not a blocking comment nor am I even asking for a change;
I'm just asking people consider this for netconf and future work.

Netconf currently recommends that netconf over ssh be run over a
different port than the normal ssh port.

That seems like a fine idea.  I think there are cases where you might
want to allow access to netconf but not allow access to the CLI
through the normal ssh port.  

However I think in many cases it would not be a security problem if
the netconf subsystem were available over the normal ssh port.  In
many applications the same privileges will be granted to users over
the CLI as to the same users over netconf.  In many cases the
functionality available through netconf will also be available through
the CLI.

--Sam


_______________________________________________
Ietf mailing list
Ietf at ietf.org
https://www1.ietf.org/mailman/listinfo/ietf