Re: Issue 9.1) DoS attack using global <lock>

[Eliot Lear <lear@cisco.com>]

Andy,

Obviously 9.1 and 9.2 are related.  So long as we note this in the 
security considerations, because the individual who is screwing up the 
lock is authenticated, I'm not even sure we need a <steal-lock> command 
to get around it.

Andy Bierman wrote:

> A DoS attack is possible if global lock allows users to 
> lock more of the config dB than they have write access. 
> Choose one of:
>   - Only users with all-access can lock the dB
>   - Only grant lock for areas that write-access is allowed
>   - Support partial locks
>   - Simply document the problem in the security section
>
>
> --
> to unsubscribe send a message to netconf-request@ops.ietf.org with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/netconf/>

--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>