--- 1/draft-ietf-opsawg-tacacs-yang-05.txt 2020-06-01 04:13:13.335637535 -0700 +++ 2/draft-ietf-opsawg-tacacs-yang-06.txt 2020-06-01 04:13:13.367638347 -0700 @@ -1,47 +1,47 @@ Network Working Group G. Zheng Internet-Draft M. Wang Intended status: Standards Track B. Wu -Expires: November 23, 2020 Huawei - May 22, 2020 +Expires: December 3, 2020 Huawei + June 1, 2020 Yang data model for TACACS+ - draft-ietf-opsawg-tacacs-yang-05 + draft-ietf-opsawg-tacacs-yang-06 Abstract - This document defines YANG modules that augment the System Management - data model defined in the RFC 7317 with TACACS+ client model. The - data model of Terminal Access Controller Access Control System Plus - (TACACS+) client allows the configuration of TACACS+ servers for - centralized Authentication, Authorization and Accounting. + This document defines a YANG module that augment the System + Management data model defined in the RFC 7317 with TACACS+ client + model. The data model of Terminal Access Controller Access Control + System Plus (TACACS+) client allows the configuration of TACACS+ + servers for centralized Authentication, Authorization and Accounting. - The YANG modules in this document conforms to the Network Management + The YANG module in this document conforms to the Network Management Datastore Architecture (NMDA) defined in RFC 8342. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on November 23, 2020. + This Internet-Draft will expire on December 3, 2020. Copyright Notice Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents @@ -51,33 +51,34 @@ the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Conventions used in this document . . . . . . . . . . . . . . 3 2.1. Tree Diagrams . . . . . . . . . . . . . . . . . . . . . . 3 3. Design of the Data Model . . . . . . . . . . . . . . . . . . 3 4. TACACS+ Client Module . . . . . . . . . . . . . . . . . . . . 5 - 5. Security Considerations . . . . . . . . . . . . . . . . . . . 11 + 5. Security Considerations . . . . . . . . . . . . . . . . . . . 12 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 13 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 13 8.1. Normative References . . . . . . . . . . . . . . . . . . 13 8.2. Informative References . . . . . . . . . . . . . . . . . 14 Appendix A. Example Tacacs+ Authentication Configuration . . . . 14 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 15 1. Introduction - This document defines YANG modules that augment the System Management - data model defined in the [RFC7317] with TACACS+ client model. + This document defines a YANG module that augment the System + Management data model defined in the [RFC7317] with TACACS+ client + model. TACACS+ provides Device Administration for routers, network access servers and other networked computing devices via one or more centralized servers which is defined in the TACACS+ Protocol. [I-D.ietf-opsawg-tacacs] The System Management Model [RFC7317] defines two YANG features to support local or RADIUS authentication: o User Authentication Model: Defines a list of usernames and @@ -86,21 +87,21 @@ o RADIUS Client Model: Defines a list of RADIUS servers that a device uses. Since TACACS+ is also used for device management and the feature is not contained in the System Management model, this document defines a YANG data model that allows users to configure TACACS+ client functions on a device for centralized Authentication, Authorization and Accounting provided by TACACS+ servers. - The YANG models can be used with network management protocols such as + The YANG model can be used with network management protocols such as NETCONF[RFC6241] to install, manipulate, and delete the configuration of network devices. The YANG data model in this document conforms to the Network Management Datastore Architecture (NMDA) defined in [RFC8342]. 2. Conventions used in this document The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and @@ -200,20 +201,22 @@ +--ro connection-aborts? yang:counter64 +--ro connection-failures? yang:counter64 +--ro connection-timeouts? yang:counter64 +--ro messages-sent? yang:counter64 +--ro messages-received? yang:counter64 +--ro errors-received? yang:counter64 +--ro sessions? yang:counter64 4. TACACS+ Client Module + This YANG module imports typedefs from [RFC6991]. + file "ietf-system-tacacsplus@2020-05-22.yang" module ietf-system-tacacsplus { yang-version 1.1; namespace "urn:ietf:params:xml:ns:yang:ietf-system-tacacsplus"; prefix sys-tcsplus; import ietf-inet-types { prefix inet; reference @@ -526,23 +531,23 @@ in some network environments. Write operations (e.g., edit-config) to these data nodes without proper protection can have a negative effect on network operations. These are the subtrees and data nodes and their sensitivity/vulnerability: /system/tacacsplus/server: This list contains the objects used to control the TACACS+ servers used by the device. Unauthorized access to this list could cause a user management failure on the device . - /system/tacacsplus/server/shared-secret: This leaf controls the - key known to both the TACACS+ client and server. Unauthorized - access to this leaf could cause the device vulnerable to attacks, + /system/tacacsplus/server/shared-secret: This leaf controls the key + known to both the TACACS+ client and server. Unauthorized access + to this leaf could cause the device vulnerable to attacks, therefore has been restricted using the "default-deny-all" access control defined in [RFC8341]. This document describes the use of TACACS+ for purposes of authentication, authorization and accounting, it is vulnerable to all of the threats that are present in TACACS+ applications. For a discussion of such threats, see Section 9 of the TACACS+ Protocol [I-D.ietf-opsawg-tacacs]. 6. IANA Considerations @@ -659,32 +664,32 @@ "timeout": "10" } ] } } } Authors' Addresses Guangying Zheng - Huawei + Huawei Technologies, Co., Ltd 101 Software Avenue, Yuhua District Nanjing, Jiangsu 210012 China Email: zhengguangying@huawei.com Michael Wang Huawei Technologies, Co., Ltd 101 Software Avenue, Yuhua District Nanjing 210012 China Email: wangzitao@huawei.com Bo Wu - Huawei + Huawei Technologies, Co., Ltd 101 Software Avenue, Yuhua District Nanjing, Jiangsu 210012 China Email: lana.wubo@huawei.com