Re: User Readable Config File (2.4.7)

["Joel N. Weber II" <ietf-opsec@joelweber.com>]

> Should it explicitly state that there MUST be support in the device to 
> encrypt all passwords and secret and private keys (SNMP community strings, 
> NTP authentication, routing authentication, AAA server keys, what else?) 
> when displaying a user readable config file ?

Possibly.  Though it is also valuable to have a way to dump the config
with all such sensitive things completely omitted (perhaps with some
sort of indication that they would be there if you had the uncensored
version), because in general, it's very hard to obscure passwords well
enough to be certain that a determined attacker can't recover them.

(And I've certainly encountered cases of sending a config file to a
router vendor's tech support, where completely omitting passwords
would be the desireable thing.)