Subject: [netmod] I-D Action: draft-ietf-netmod-system-mgmt-15.txt

From: [email-masked]
Date: Tue, 29 Apr 2014 00:17:43 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the NETCONF Data Modeling Language Working Group of the IETF.

        Title           : A YANG Data Model for System Management
        Authors         : Andy Bierman
                          Martin Bjorklund
	Filename        : draft-ietf-netmod-system-mgmt-15.txt
	Pages           : 40
	Date            : 2014-04-29

Abstract:
   This document defines a YANG data model for the configuration and
   identification of some common system properties within a device
   containing a NETCONF server.  This includes data node definitions for
   system identification, time-of-day management, user management, DNS
   resolver configuration, and some protocol operations for system
   management.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-netmod-system-mgmt/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-netmod-system-mgmt-15

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-netmod-system-mgmt-15

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Kent Watsen <[email-masked]>
Date: Wed, 30 Apr 2014 01:23:16 +0000

I noticed this draft up for Last Call again and yet the issues raised here
haven¹t been addressed yet:

	http://www.ietf.org/mail-archive/web/netconf/current/msg08848.html

Now I see that we have another go at a Last Call for this draft, can we
please fix these issue this time?  It doesn¹t make sense to have these
things configured in the netconf-server-model draft...

Thanks,
Kent

On 4/29/14, 3:17 AM, "[email-masked]" <[email-masked]>
wrote:

>_______________________________________________
>netmod mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/netmod

---

From: Andy Bierman <[email-masked]>
Date: Wed, 30 Apr 2014 10:04:40 -0700

> things configured in the netconf-server-model draft...
Can you provide an OLD vs NEW style text change proposal that shows what
will
change in the system draft?

> Kent
Andy

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 30 Apr 2014 21:49:51 +0200

> things configured in the netconf-server-model draft...

Kent,

the process is somewhat like this (a bit simplified):

a) WG works on a document does WG last calls to determine the WG
   is done an happy with the result

b) Work is submitted to the IESG and the responsible AD initiates
   an IETF last call to check that the larger IETF community is
   fine with the result produced by the WG

c) The IESG members review the documents (and the IETF last call
   comments) and IESG members can raise DISCUSSes that require to
   discuss whether there is an issue preventing the publication
   of the document

The main reason why we have a second IETF last call is the fact that
we have a normative reference to a document that is not on the
standards track and this was not properly spelled out in the first
IETF last call - so we are essentially fixing a procedural error.

Of course, since there is another IETF last call, you can raise an
issue during this second IETF last call if you believe the document is
not ready.

So much about the process. Taking the process aside, we did receive
several comments of the form "why does the data model not also cover
XYZ" during the IESG review phase and we consistently answered that
trying to cover everything means we will never finish this data model
and that we (the chairs) believe the current scope has WG consensus
and that it is time to get this published, implemented, and deployed.
We do expect revisions and / or extensions of the data model based on
experience we gain.

You can find the history of this document here:

https://datatracker.ietf.org/doc/draft-ietf-netmod-system-mgmt/history/

It took us about two years from the WG -00 version to IESG submission
and almost three years from Andy's original I-D. I am strongly in
favour of publishing what we have. Note that it is possible both to
revise data models and to augment them and we kind of expect this to
happen with the core system data model.

So keep this in mind when you think about the issue. Are we having an
issue that renders the current version unusable or is this just one of
the many additions one can imagine but which may as well go into a
future revision or augmentation of the data model? In the later case,
I prefer to not pull this document out of the IESG back into the WG.

/js

PS: Note that it took 8 months from the initial submission of an
    individual I-D for the RFC 6021 revision to IESG approval (with 4
    months since WG -00 version). It is well possible to revise a data
    model within a year should there be a need.

PS: I personally do not believe that the user authentation objects in
    the sytem draft need configuration of certifications and trust
    anchors.

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Kent Watsen <[email-masked]>
Date: Thu, 1 May 2014 04:18:33 +0000

Hi Juergen,

> Kent,
>
> the process is somewhat like this
> <snip/>
 
I can¹t help the timing on this.  The reason this is coming up now is
because the NETCONF WG wanted to unify the TLS and SSH config, which meant
that suddenly the TLS config showed up in a the
draft-ietf-netconf-server-model, which is supposed to be about configuring
the server (not user auth).  Maybe the issue can be traced to 5539bis-00
(Sep 2012), as that is where the TLS-auth config was very first
introduced.  Perhaps it should¹ve been put into the
draft-ietf-netmod-system-mgmt at that time, but the issue was less visible
then since it kind of makes sense that the config would be in the 5539bis.
 In fact, Tom said as much here:
http://www.ietf.org/mail-archive/web/netconf/current/msg08841.html.

>issue during this second IETF last call if you believe the document is

And that we should do if we agree that it¹s the best course of action.

><history deleted>

The problem is that if it doesn¹t go into draft-ietf-netmod-system-mgmt,
then the alternative solutions (see bottom) may compound the problem.  Now
is the time for us to at least look at it and agree what makes sense.  I¹m
all for us doing the right thing, whatever it might be, but we haven¹t
even discussed what that is yet.

>    the sytem draft need configuration of certifications and trust

Great, the discussion begins, so here goes.

The netmod-system-management defines config for User Authentication and
says that it does so for SSH because that is NETCONF¹s mandatory to
implement transport.  Meanwhile we have netconf-server-model, which is
suppose to be just about configuring the NETCONF server, and yet it has
user-auth config for TLS (not SSH) in it.  This inconsistency is the issue.

So, what are our options?

1. Go forward with current inconsistency

2. Only modify draft-ietf-netconf-server-model, but move TLS user-auth out
   of ietf-server-model into a separate model that augments ietf-system

3. Similar to #2, but move the ietf-system augmentation back to 5539bis

4. Similar to #2, but move the TLS-auth directly (no augmentation) into
   the ietf-system model defined in draft-ietf-netmod-system-mgmt

5. Move all user-auth config from draft-ietf-netmod-system-mgmt into
   draft-ietf-netconf-server-model

6. Move all user-auth config from both draft-ietf-netmod-system-mgmt
   and draft-ietf-netconf-server-model into yet another draft (for
   instance, draft-ietf-netmod-user-auth?)

7. Anything else?

Thanks,
Kent