Using the NETCONF Protocol over Secure Shell (SSH)
RFC 6242

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 08

Internet Engineering Task Force (IETF)                      M. Wasserman
Request for Comments: 6242                        Painless Security, LLC
Obsoletes: 4742                                                June 2011
Category: Standards Track
ISSN: 2070-1721

           Using the NETCONF Protocol over Secure Shell (SSH)

Abstract

   This document describes a method for invoking and running the Network
   Configuration Protocol (NETCONF) within a Secure Shell (SSH) session
   as an SSH subsystem.  This document obsoletes RFC 4742.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc6242.

Copyright Notice

   Copyright (c) 2011 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Wasserman                    Standards Track                    [Page 1]
RFC 6242                    NETCONF over SSH                   June 2011

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
   2.  Requirements Terminology . . . . . . . . . . . . . . . . . . .  2
   3.  Starting NETCONF over SSH  . . . . . . . . . . . . . . . . . .  2
     3.1.  Capabilities Exchange  . . . . . . . . . . . . . . . . . .  3
   4.  Using NETCONF over SSH . . . . . . . . . . . . . . . . . . . .  4
     4.1.  Framing Protocol . . . . . . . . . . . . . . . . . . . . .  5
     4.2.  Chunked Framing Mechanism  . . . . . . . . . . . . . . . .  5
     4.3.  End-of-Message Framing Mechanism . . . . . . . . . . . . .  7
   5.  Exiting the NETCONF Subsystem  . . . . . . . . . . . . . . . .  8
   6.  Security Considerations  . . . . . . . . . . . . . . . . . . .  8
   7.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . .  9
   8.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 10
   9.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 10
     9.1.  Normative References . . . . . . . . . . . . . . . . . . . 10
     9.2.  Informative References . . . . . . . . . . . . . . . . . . 10
   Appendix A.  Changes from RFC 4742 . . . . . . . . . . . . . . . . 11

1.  Introduction

   The NETCONF protocol [RFC6241] is an XML-based protocol used to
   manage the configuration of networking equipment.  NETCONF is defined
   to be session-layer and transport independent, allowing mappings to
   be defined for multiple session-layer or transport protocols.  This
   document defines how NETCONF can be used within a Secure Shell (SSH)
   session, using the SSH connection protocol [RFC4254] over the SSH
   transport protocol [RFC4253].  This mapping will allow NETCONF to be
   executed from a secure shell session by a user or application.

   Although this document gives specific examples of how NETCONF
   messages are sent over an SSH connection, use of this transport is
   not restricted to the messages shown in the examples below.  This
   transport can be used for any NETCONF message.

2.  Requirements Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [RFC2119].

3.  Starting NETCONF over SSH

   To run NETCONF over SSH, the SSH client will first establish an SSH
   transport connection using the SSH transport protocol, and the SSH
   client and SSH server will exchange keys for message integrity and
   encryption.  The SSH client will then invoke the "ssh-userauth"
   service to authenticate the user, as described in the SSH

Wasserman                    Standards Track                    [Page 2]
RFC 6242                    NETCONF over SSH                   June 2011

   authentication protocol [RFC4252].  Once the user has been
   successfully authenticated, the SSH client will invoke the
   "ssh-connection" service, also known as the SSH connection protocol.

   The username provided by the SSH implementation will be made