Using the NETCONF Protocol over Secure Shell (SSH)
RFC 6242
Document | Type |
RFC - Proposed Standard
(June 2011; No errata)
Obsoletes RFC 4742
|
|
---|---|---|---|
Author | Margaret Cullen | ||
Last updated | 2020-07-29 | ||
Stream | IETF | ||
Formats | plain text html pdf htmlized bibtex | ||
Reviews | |||
Stream | WG state | WG Document | |
Document shepherd | No shepherd assigned | ||
IESG | IESG state | RFC 6242 (Proposed Standard) | |
Action Holders |
(None)
|
||
Consensus Boilerplate | Unknown | ||
Telechat date | |||
Responsible AD | Dan Romascanu | ||
IESG note | Mehmet Ersue (mehmet.ersue@nsn.com) is the document shepherd. | ||
Send notices to | (None) |
Internet Engineering Task Force (IETF) M. Wasserman Request for Comments: 6242 Painless Security, LLC Obsoletes: 4742 June 2011 Category: Standards Track ISSN: 2070-1721 Using the NETCONF Protocol over Secure Shell (SSH) Abstract This document describes a method for invoking and running the Network Configuration Protocol (NETCONF) within a Secure Shell (SSH) session as an SSH subsystem. This document obsoletes RFC 4742. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6242. Copyright Notice Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Wasserman Standards Track [Page 1] RFC 6242 NETCONF over SSH June 2011 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Requirements Terminology . . . . . . . . . . . . . . . . . . . 2 3. Starting NETCONF over SSH . . . . . . . . . . . . . . . . . . 2 3.1. Capabilities Exchange . . . . . . . . . . . . . . . . . . 3 4. Using NETCONF over SSH . . . . . . . . . . . . . . . . . . . . 4 4.1. Framing Protocol . . . . . . . . . . . . . . . . . . . . . 5 4.2. Chunked Framing Mechanism . . . . . . . . . . . . . . . . 5 4.3. End-of-Message Framing Mechanism . . . . . . . . . . . . . 7 5. Exiting the NETCONF Subsystem . . . . . . . . . . . . . . . . 8 6. Security Considerations . . . . . . . . . . . . . . . . . . . 8 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 10 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 10 9.1. Normative References . . . . . . . . . . . . . . . . . . . 10 9.2. Informative References . . . . . . . . . . . . . . . . . . 10 Appendix A. Changes from RFC 4742 . . . . . . . . . . . . . . . . 11 1. Introduction The NETCONF protocol [RFC6241] is an XML-based protocol used to manage the configuration of networking equipment. NETCONF is defined to be session-layer and transport independent, allowing mappings to be defined for multiple session-layer or transport protocols. This document defines how NETCONF can be used within a Secure Shell (SSH) session, using the SSH connection protocol [RFC4254] over the SSH transport protocol [RFC4253]. This mapping will allow NETCONF to be executed from a secure shell session by a user or application. Although this document gives specific examples of how NETCONF messages are sent over an SSH connection, use of this transport is not restricted to the messages shown in the examples below. This transport can be used for any NETCONF message. 2. Requirements Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. 3. Starting NETCONF over SSH To run NETCONF over SSH, the SSH client will first establish an SSH transport connection using the SSH transport protocol, and the SSH client and SSH server will exchange keys for message integrity and encryption. The SSH client will then invoke the "ssh-userauth" service to authenticate the user, as described in the SSH Wasserman Standards Track [Page 2] RFC 6242 NETCONF over SSH June 2011 authentication protocol [RFC4252]. Once the user has been successfully authenticated, the SSH client will invoke the "ssh-connection" service, also known as the SSH connection protocol. The username provided by the SSH implementation will be madeShow full document text