Re: [Netconf] <edit-config> and remote URLs

[Martin Bjorklund <mbj at tail-f.com>]

Juergen Schoenwaelder <j.schoenwaelder at jacobs-university.de> wrote:
> On Fri, Oct 02, 2009 at 01:08:11PM +0200, Martin Bjorklund wrote:
>  
> > I think this should be ok.  The only operation that is restricted to
> > local files is <delete-config>.
> > 
> > Hmm.. the reason for restricting <delete-config> to local files was
> > for security.  We don't want the NETCONF server to delete files on
> > remote computers; it is pointless.  But <copy-config> to a remote file
> > is allowed, so you can get the NETCONF server to overwrite remote
> > files.
> 
> I fail to follow the logic - why is overwriting OK but deleting not?

That's what I meant - the reasoning is flawed.

> At the end, it is a matter of the remote ftp/http/... server to
> enforce access control rules.

So we should simply remove the text about local config files then.


/martin