draft-ietf-opsawg-tacacs-yang-04.txt   draft-ietf-opsawg-tacacs-yang-05.txt 
Network Working Group G. Zheng Network Working Group G. Zheng
Internet-Draft M. Wang Internet-Draft M. Wang
Intended status: Standards Track B. Wu Intended status: Standards Track B. Wu
Expires: November 9, 2020 Huawei Expires: November 23, 2020 Huawei
May 8, 2020 May 22, 2020
Yang data model for TACACS+ Yang data model for TACACS+
draft-ietf-opsawg-tacacs-yang-04 draft-ietf-opsawg-tacacs-yang-05
Abstract Abstract
This document defines YANG modules that augment the System Management This document defines YANG modules that augment the System Management
data model defined in the RFC 7317 with TACACS+ client model. The data model defined in the RFC 7317 with TACACS+ client model. The
data model of Terminal Access Controller Access Control System Plus data model of Terminal Access Controller Access Control System Plus
(TACACS+) client allows the configuration of TACACS+ servers for (TACACS+) client allows the configuration of TACACS+ servers for
centralized Authentication, Authorization and Accounting. centralized Authentication, Authorization and Accounting.
The YANG modules in this document conforms to the Network Management The YANG modules in this document conforms to the Network Management
skipping to change at page 1, line 38 skipping to change at page 1, line 38
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on November 9, 2020. This Internet-Draft will expire on November 23, 2020.
Copyright Notice Copyright Notice
Copyright (c) 2020 IETF Trust and the persons identified as the Copyright (c) 2020 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 18 skipping to change at page 2, line 18
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Conventions used in this document . . . . . . . . . . . . . . 3 2. Conventions used in this document . . . . . . . . . . . . . . 3
2.1. Tree Diagrams . . . . . . . . . . . . . . . . . . . . . . 3 2.1. Tree Diagrams . . . . . . . . . . . . . . . . . . . . . . 3
3. Design of the Data Model . . . . . . . . . . . . . . . . . . 3 3. Design of the Data Model . . . . . . . . . . . . . . . . . . 3
4. TACACS+ Client Module . . . . . . . . . . . . . . . . . . . . 5 4. TACACS+ Client Module . . . . . . . . . . . . . . . . . . . . 5
5. Security Considerations . . . . . . . . . . . . . . . . . . . 11 5. Security Considerations . . . . . . . . . . . . . . . . . . . 11
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12
7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 12 7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 13
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 13 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 13
8.1. Normative References . . . . . . . . . . . . . . . . . . 13 8.1. Normative References . . . . . . . . . . . . . . . . . . 13
8.2. Informative References . . . . . . . . . . . . . . . . . 14 8.2. Informative References . . . . . . . . . . . . . . . . . 14
Appendix A. Example Tacacs+ Authentication Configuration . . . . 14 Appendix A. Example Tacacs+ Authentication Configuration . . . . 14
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 15 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 15
1. Introduction 1. Introduction
This document defines YANG modules that augment the System Management This document defines YANG modules that augment the System Management
data model defined in the [RFC7317] with TACACS+ client model. data model defined in the [RFC7317] with TACACS+ client model.
skipping to change at page 5, line 36 skipping to change at page 5, line 36
+--ro connection-aborts? yang:counter64 +--ro connection-aborts? yang:counter64
+--ro connection-failures? yang:counter64 +--ro connection-failures? yang:counter64
+--ro connection-timeouts? yang:counter64 +--ro connection-timeouts? yang:counter64
+--ro messages-sent? yang:counter64 +--ro messages-sent? yang:counter64
+--ro messages-received? yang:counter64 +--ro messages-received? yang:counter64
+--ro errors-received? yang:counter64 +--ro errors-received? yang:counter64
+--ro sessions? yang:counter64 +--ro sessions? yang:counter64
4. TACACS+ Client Module 4. TACACS+ Client Module
<CODE BEGINS> file "ietf-system-tacacsplus@2020-05-09.yang" <CODE BEGINS> file "ietf-system-tacacsplus@2020-05-22.yang"
module ietf-system-tacacsplus {
yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-system-tacacsplus";
prefix sys-tcsplus;
import ietf-inet-types { module ietf-system-tacacsplus {
prefix inet; yang-version 1.1;
reference namespace "urn:ietf:params:xml:ns:yang:ietf-system-tacacsplus";
"RFC 6991: Common YANG Data Types"; prefix sys-tcsplus;
}
import ietf-yang-types {
prefix yang;
reference
"RFC 6991: Common YANG Data Types";
}
import ietf-network-instance {
prefix ni;
reference
"RFC 8529: YANG Data Model for Network Instances";
}
import ietf-interfaces {
prefix if;
reference
"RFC 8343: A YANG Data Model for Interface Management";
}
import ietf-system {
prefix sys;
reference
"RFC 7317: A YANG Data Model for System Management";
}
import ietf-netconf-acm {
prefix nacm;
reference
"RFC 8341: Network Configuration Access Control Model";
}
organization import ietf-inet-types {
"IETF Opsawg (Operations and Management Area Working Group)"; prefix inet;
contact reference
"WG Web: <http://tools.ietf.org/wg/opsawg/> "RFC 6991: Common YANG Data Types";
WG List: <mailto:opsawg@ietf.org> }
import ietf-yang-types {
prefix yang;
reference
"RFC 6991: Common YANG Data Types";
}
import ietf-network-instance {
prefix ni;
reference
"RFC 8529: YANG Data Model for Network Instances";
}
import ietf-interfaces {
prefix if;
reference
"RFC 8343: A YANG Data Model for Interface Management";
}
import ietf-system {
prefix sys;
reference
"RFC 7317: A YANG Data Model for System Management";
}
import ietf-netconf-acm {
prefix nacm;
reference
"RFC 8341: Network Configuration Access Control Model";
}
Editor: Bo Wu <lana.wubo@huawei.com> organization
Editor: Guangying Zheng <zhengguangying@huawei.com>"; "IETF Opsawg (Operations and Management Area Working Group)";
description contact
"This module provides configuration of TACACS+ client. "WG Web: <http://tools.ietf.org/wg/opsawg/>
WG List: <mailto:opsawg@ietf.org>
Copyright (c) 2020 IETF Trust and the persons identified as Editor: Bo Wu <lana.wubo@huawei.com>
authors of the code. All rights reserved. Editor: Guangying Zheng <zhengguangying@huawei.com>";
description
"This module provides configuration of TACACS+ client.
Redistribution and use in source and binary forms, with or Copyright (c) 2020 IETF Trust and the persons identified as
without modification, is permitted pursuant to, and subject authors of the code. All rights reserved.
to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see the Redistribution and use in source and binary forms, with or
RFC itself for full legal notices."; without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD License
set forth in Section 4.c of the IETF Trust's Legal Provisions
Relating to IETF Documents
(http://trustee.ietf.org/license-info).
revision 2020-05-09 { This version of this YANG module is part of RFC XXXX; see the
description RFC itself for full legal notices.";
"Initial revision.";
reference // RFC Ed.: update the date below with the date of RFC
"RFC XXXX: A Yang Data Model for TACACS+"; // publication and remove this note.
} // RFC Ed.: replace XXXX with actual RFC number and remove
// this note, and the TACACS+ Protocol refers to
// draft-ietf-opsawg-tacacs.
typedef tcsplus-server-type { revision 2020-05-22 {
type bits { description
bit authentication { "Initial revision.";
description reference
"When set, the server is an authentication server."; "RFC XXXX: A Yang Data Model for TACACS+";
} }
bit authorization {
description
"When set, the server is an authorization server.";
}
bit accounting {
description
"When set, the server is an accounting server.";
}
}
description
"server-type can be set to authentication/authorization/accounting
or any combination of the three types. When all three types are
supported, all the three bits are set.";
}
feature tacacsplus { typedef tcsplus-server-type {
description type bits {
"Indicates that the device can be configured as a TACACS+ bit authentication {
client."; description
reference "When set, the server is an authentication server.";
"draft-ietf-opsawg-tacacs-18: The TACACS+ Protocol"; }
} bit authorization {
description
"When set, the server is an authorization server.";
}
bit accounting {
description
"When set, the server is an accounting server.";
}
}
description
"tcsplus-server-type can be set to
authentication/authorization/accounting
or any combination of the three types. When all three types are
supported, all the three bits are set.";
}
identity tacacsplus { feature tacacsplus {
base sys:authentication-method; description
description "Indicates that the device can be configured as a TACACS+
"Indicates AAA operation using TACACS+."; client.";
reference reference
"draft-ietf-opsawg-tacacs-18: The TACACS+ Protocol"; "RFC XXXX : The TACACS+ Protocol ";
} }
grouping statistics { identity tacacsplus {
description base sys:authentication-method;
"Grouping for TACACS+ statistics attributes"; description
container statistics { "Indicates AAA operation using TACACS+.";
config false; reference
description "RFC XXXX: The TACACS+ Protocol";
"A collection of server-related statistics objects"; }
grouping statistics {
description
"Grouping for TACACS+ statistics attributes";
container statistics {
config false;
description
"A collection of server-related statistics objects";
leaf connection-opens {
type yang:counter64;
description
"Number of new connection requests sent to the server, e.g.
socket open";
}
leaf connection-closes {
type yang:counter64;
description
"Number of connection close requests sent to the server, e.g.
socket close";
}
leaf connection-aborts {
type yang:counter64;
description
"Number of aborted connections to the server. These do
not include connections that are close gracefully.";
}
leaf connection-failures {
type yang:counter64;
description
"Number of connection failures to the server";
}
leaf connection-timeouts {
type yang:counter64;
description
"Number of connection timeouts to the server";
}
leaf messages-sent {
type yang:counter64;
description
"Number of messages sent to the server";
}
leaf messages-received {
type yang:counter64;
description
"Number of messages received from the server";
}
leaf errors-received {
type yang:counter64;
description
"Number of error messages received from the server";
}
leaf sessions {
type yang:counter64;
description
"Number of TACACS+ sessions completed with the server.
If the Single Connection Mode was NOT enabled, the number of
sessions is the same as the number of 'connection-closes'.
If the Mode was enabled, a single TCP connection may contain
multiple TACACS+ sessions.";
}
}
}
leaf connection-opens { grouping tacacsplus {
type yang:counter64; description
description "Grouping for TACACS+ attributes";
"Number of new connection requests sent to the server, e.g. container tacacsplus {
socket open"; if-feature "tacacsplus";
} must "not(derived-from-or-self(../sys:authentication"
leaf connection-closes { + "/sys:user-authentication-order, 'tacacsplus')) or server" {
type yang:counter64; error-message "When 'tacacsplus' is used as a system"
description + " authentication method, a TACACS+ server"
"Number of connection close requests sent to the server, e.g. + " must be configured.";
socket close"; description
} "When 'tacacsplus' is used as an authentication method,
leaf connection-aborts { a TACACS+ server must be configured.";
type yang:counter64; }
description description
"Number of aborted connections to the server. These do "Container for TACACS+ configurations and operations.";
not include connections that are close gracefully."; list server {
} key "name";
leaf connection-failures { ordered-by user;
type yang:counter64; description
description "List of TACACS+ servers used by the device.";
"Number of connection failures to the server"; leaf name {
} type string;
leaf connection-timeouts { description
type yang:counter64; "An arbitrary name for the TACACS+ server.";
description }
"Number of connection timeouts to the server"; leaf server-type {
} type tcsplus-server-type;
leaf messages-sent { description
type yang:counter64; "Server type: authentication/authorization/accounting and
description various combinations.
"Number of messages sent to the server"; When all three types are supported, all the three bits
} are set.";
leaf messages-received { }
type yang:counter64; leaf address {
description type inet:host;
"Number of messages received by the server"; mandatory true;
} description
leaf errors-received { "The address of the TACACS+ server.";
type yang:counter64; }
description leaf port {
"Number of error messages received from the server"; type inet:port-number;
} default "49";
leaf sessions { description
type yang:counter64; "The port number of TACACS+ Server port.";
description }
"Number of TACACS+ sessions completed with the server. leaf shared-secret {
If the Single Connection Mode was NOT enabled, the number of type string {
sessions is the same as the number of 'connection-closes'. length "16..max";
If the Mode was enabled, a single TCP connection may contain }
multiple TACACS+ sessions."; mandatory true;
} nacm:default-deny-all;
} description
} "The shared secret, which is known to both the
TACACS+ client and server. TACACS+ server administrators
should configure shared secret of minimum 16 characters
length.
It is highly recommended that shared keys are at least 32
characters long.";
reference
"RFC XXXX: The TACACS+ Protocol";
}
choice source-type {
description
"The source address type for outbound TACACS+ packets.";
case source-ip {
leaf source-ip {
type inet:ip-address;
description
"Specifies source IP address for TACACS+ outbound
packets.";
}
}
case source-interface {
leaf source-interface {
type if:interface-ref;
description
"Specifies the interface from which the IP address is
derived for use as the source for the outbound TACACS+
packet";
}
}
grouping tacacsplus { }
description leaf vrf-instance {
"Grouping for TACACS+ attributes"; type leafref {
container tacacsplus { path "/ni:network-instances/ni:network-instance/ni:name";
if-feature "tacacsplus"; }
must "not(derived-from-or-self(../sys:authentication" description
+ "/sys:user-authentication-order, 'tacacsplus')) or server" { "Specifies the VPN Routing and Forwarding (VRF) instance to
error-message "When 'tacacsplus' is used as a system" use to communicate with the TACACS+ server.";
+ " authentication method, a TACACS+ server" }
+ " must be configured."; leaf single-connection {
description type boolean;
"When 'tacacsplus' is used as an authentication method, default "false";
a TACACS+ server must be configured."; description
} "Whether the single connection mode is enabled for the
description server. By default, the single connection mode is
"Container for TACACS+ configurations and operations."; disabled.";
list server { }
key "name"; leaf timeout {
ordered-by user; type uint16 {
description range "1..300";
"List of TACACS+ servers used by the device."; }
leaf name { units "seconds";
type string; default "5";
description description
"An arbitrary name for the TACACS+ server."; "The number of seconds the device will wait for a
} response from each TACACS+ server before trying with a
leaf server-type { different server.";
type tcsplus-server-type; }
description uses statistics;
"Server type: authentication/authorization/accounting and }
various combinations. }
When all three types are supported, all the three bits }
are set.";
}
leaf address {
type inet:host;
mandatory true;
description
"The address of the TACACS+ server.";
}
leaf port {
type inet:port-number;
default "49";
description
"The port number of TACACS+ Server port.";
}
leaf shared-secret {
type string {
length "16..max";
}
mandatory true;
nacm:default-deny-all;
description
"The shared secret, which is known to both the
TACACS+ client and server. TACACS+ server administrators
should configure shared secret of minimum 16 characters
length.
It is highly recommended that shared keys are at least 32
characters long.";
reference
"TACACS+ protocol";
}
choice source-type {
description
"The source address type for outbound TACACS+ packets.";
case source-ip {
leaf source-ip {
type inet:ip-address;
description
"Specifies source IP address for TACACS+ outbound
packets.";
}
}
case source-interface {
leaf source-interface {
type if:interface-ref;
description
"Specifies the interface from which the IP address is
derived for use as the source for the outbound TACACS+
packet";
}
}
}
leaf vrf-instance {
type leafref {
path "/ni:network-instances/ni:network-instance/ni:name";
}
description
"Specifies the VPN Routing and Forwarding (VRF) instance to
use to communicate with the TACACS+ server.";
}
leaf single-connection {
type boolean;
default "false";
description
"Whether the single connection mode is enabled for the
server. By default, the single connection mode is
disabled.";
}
leaf timeout {
type uint16 {
range "1..300";
}
units "seconds";
default "5";
description
"The number of seconds the device will wait for a
response from each TACACS+ server before trying with a
different server.";
}
uses statistics;
}
}
}
augment "/sys:system" { augment "/sys:system" {
description description
"Augment the system model with the tacacsplus model"; "Augment the system model with the tacacsplus model";
uses tacacsplus; uses tacacsplus;
} }
} }
<CODE ENDS> <CODE ENDS>
5. Security Considerations 5. Security Considerations
The YANG module defined in this document is designed to be accessed The YANG module defined in this document is designed to be accessed
via network management protocols such as NETCONF [RFC6241] or via network management protocols such as NETCONF [RFC6241] or
RESTCONF [RFC8040]. The lowest NETCONF layer is the secure transport RESTCONF [RFC8040]. The lowest NETCONF layer is the secure transport
layer, and the mandatory-to-implement secure transport is Secure layer, and the mandatory-to-implement secure transport is Secure
Shell (SSH) [RFC6242]. The lowest RESTCONF layer is HTTPS, and the Shell (SSH) [RFC6242]. The lowest RESTCONF layer is HTTPS, and the
skipping to change at page 12, line 20 skipping to change at page 12, line 27
effect on network operations. These are the subtrees and data nodes effect on network operations. These are the subtrees and data nodes
and their sensitivity/vulnerability: and their sensitivity/vulnerability:
/system/tacacsplus/server: This list contains the objects used to /system/tacacsplus/server: This list contains the objects used to
control the TACACS+ servers used by the device. Unauthorized control the TACACS+ servers used by the device. Unauthorized
access to this list could cause a user management failure on the access to this list could cause a user management failure on the
device . device .
/system/tacacsplus/server/shared-secret: This leaf controls the /system/tacacsplus/server/shared-secret: This leaf controls the
key known to both the TACACS+ client and server. Unauthorized key known to both the TACACS+ client and server. Unauthorized
access to this leaf could cause the device vulnerable to attacks. access to this leaf could cause the device vulnerable to attacks,
therefore has been restricted using the "default-deny-all" access
control defined in [RFC8341].
This document describes the use of TACACS+ for purposes of This document describes the use of TACACS+ for purposes of
authentication, authorization and accounting, it is vulnerable to all authentication, authorization and accounting, it is vulnerable to all
of the threats that are present in TACACS+ applications. For a of the threats that are present in TACACS+ applications. For a
discussion of such threats, see Section 9 of the TACACS+ Protocol discussion of such threats, see Section 9 of the TACACS+ Protocol
[I-D.ietf-opsawg-tacacs]. [I-D.ietf-opsawg-tacacs].
6. IANA Considerations 6. IANA Considerations
This document registers a URI in the IETF XML registry [RFC3688]. This document registers a URI in the IETF XML registry [RFC3688].
skipping to change at page 12, line 44 skipping to change at page 13, line 8
URI: urn:ietf:params:xml:ns:yang:ietf-system-tacacsplus URI: urn:ietf:params:xml:ns:yang:ietf-system-tacacsplus
Registrant Contact: The IESG. Registrant Contact: The IESG.
XML: N/A, the requested URI is an XML namespace. XML: N/A, the requested URI is an XML namespace.
This document registers a YANG module in the YANG Module Names This document registers a YANG module in the YANG Module Names
registry [RFC7950]. registry [RFC7950].
Name: ietf-system-tacacsplus Name: ietf-system-tacacsplus
Namespace: urn:ietf:params:xml:ns:yang: ietf-tacacsplus Namespace: urn:ietf:params:xml:ns:yang: ietf-tacacsplus
Prefix: sys-tcsplus Prefix: sys-tcsplus
Reference: RFC XXXX Reference: RFC XXXX (RFC Ed.: replace XXXX with actual
RFC number and remove this note.)
7. Acknowledgments 7. Acknowledgments
The authors wish to thank Alex Campbell, John Heasley, Ebben Aries, The authors wish to thank Alex Campbell, John Heasley, Ebben Aries,
Alan DeKok, Joe Clarke, Joe Clarke, Tom Petch, and many others for Alan DeKok, Joe Clarke, Joe Clarke, Tom Petch, and many others for
their helpful comments and suggestions. their helpful comments and suggestions.
8. References 8. References
8.1. Normative References 8.1. Normative References
 End of changes. 22 change blocks. 
283 lines changed or deleted 291 lines changed or added

This html diff was produced by rfcdiff 1.47. The latest version is available from http://tools.ietf.org/tools/rfcdiff/