Re: [Netconf] notification access control

[Andy Bierman <andy at netconfcentral.com>]

Randy Presuhn wrote:
> Hi -
>
> > From: "Andy Bierman" <andy at netconfcentral.com>
> > To: "Randy Presuhn" <randy_presuhn at mindspring.com>
> > Cc: "NETCONF" <netconf at ietf.org>
> > Sent: Thursday, June 18, 2009 5:00 AM
> > Subject: Re: [Netconf] notification access control
> ...
> > Depending on the environment, the operator can configure
> > the ACM to do the right thing.
>
> The point is this: configuring the ACM to "do the right thing"
> would mean that notification payload redaction would not
> happen, because the cases where redaction would occur
> should have been precluded by access control to begin with.
> Or is the idea that payload redaction would function
> as a kind of "harm reduction" in cases where the security
> administrator didn't set up notification access control correctly?

I don't agree with you that all-or-nothing is always the
best choice for delivering notifications.  It is up to the
operator to decide which data is sensitive.

The scenario you are describing is not well-suited to a
single monolithic agent at all.  Instead, each customer
should get their own virtual agent, and use some
sort of proprietary 'glue code' to let each virtual agent have
access to a subset of the real agent.


> Randy

Andy