1 RFC 4247 Update Status draft-ietf-netconf-rfc4742bis-01.txt Margaret Wasserman IETF 78, Maastricht July 26, 2010

2 Status Document last updated in June 2010 Two issues raised: –Additional tuning needed for operation vs. command wording. Resolved on list, resolution confirmed on July 15, –SSH user name issues raised by Juergen Schoenwaelder. Not yet resolved.

3 SSH Username Issue RFC 4741bis has been updated to say: –The authentication process MUST result in an authenticated client identity whose permissions are known to the server. So, the NETCONF over SSH spec must state how the NETCONF application running on the SSH server can obtain a user name. However, here is no standard way for an application running on an SSH server to determine a user name for the current a session.

4 Possible Solution #1 For each SSH authentication protocols, state whether the SSH user name is found in SSH_MSG_USERAUTH_REQUEST. If not, state how it should be found instead. Issues: violates abstraction, bypasses implementation-supported ways to get this information, some SSH servers modify client- provided user name to get actual local user name (e.g. mrw => lilac\mrw on Windows).

5 Possible Solutions #2 RFC 5592 (the SSH model for SNMP) says in section 4.1.1, “How the SSH user name is extracted from the SSH layer is implementation-dependent.” Would it be acceptable to similarly state that the method to obtain a user name in NETCONF over SSH is implementation-dependent?