A YANG Data Model for System Management
Extracted elements (29)
Optional YANG features (local-users, radius-authentication, ntp, ntp-udp-port, timezone-name, dns-udp-tcp-port) are used instead of mandatory nodes so that implementations can advertise exactly which subset of capabilities they support, avoiding non-conformance for commonly unsupported options like non-default NTP or DNS ports.
The crypt-hash '$0$' prefix for clear-text input allows clients to send unencrypted passwords; the server is responsible for hashing and storing the result. This avoids requiring clients to implement the crypt() function while still ensuring passwords are never stored in clear text.
The user-authentication-order leaf-list uses an ordered list of identityrefs rather than a fixed enum, enabling future standards or vendors to define additional authentication methods without revising this module.
If a device implements the SNMPv2-MIB (RFC 3418), implementations MAY map /system/contact to sysContact and /system/location to sysLocation; size and character-set differences between the YANG leaves and the MIB objects must be handled by an implementation-specific mechanism.
New 'case' statements for timezone, NTP transport, DNS transport, or RADIUS transport MAY be added in future revisions of this data model or through augmentation, preserving extensibility without breaking existing implementations.
A server SHOULD send an RPC reply to the client before restarting or shutting down the system (applies to both system-restart and system-shutdown operations).
The authentication parameters defined in this document are primarily for NETCONF user authentication but MAY also be used by other interfaces such as a CLI or web-based UI.
The set-current-datetime RPC must fail with error-tag 'operation-failed' and error-app-tag 'ntp-active' if the system is using NTP (i.e., /system/ntp/enabled is 'true').
The usage of MD5 (crypt-hash id '$1$') is NOT RECOMMENDED; RFC 6151 security considerations for MD5 apply. Implementations should prefer SHA-256 or SHA-512 hash functions.
When 'radius' is included in the user-authentication-order leaf-list, a RADIUS server MUST be configured under /system/radius/server; a YANG 'must' constraint enforces this with the error message 'When radius is used, a RADIUS server must be configured.'
SSH public key data is stored in /system/authentication/user/authorized-key with a mandatory 'algorithm' string (from the IANA SSH Public Key Algorithm Names registry) and mandatory 'key-data' binary field encoding the SSH certificate or public key as specified in RFC 4253 Section 6.6.
System identification is split into writable configuration nodes (/system/contact, /system/hostname, /system/location) and read-only state nodes under /system-state/platform (os-name, os-release, os-version, machine), the latter being vendor-specific.
The DNS resolver is configured under /system/dns-resolver with a user-ordered 'search' leaf-list, a user-ordered 'server' list using udp-and-tcp transport (address mandatory, port optional via feature, default 53), and resolver options 'timeout' (default 5 s) and 'attempts' (default 2).
The 'iana-crypt-hash' YANG module defines the 'crypt-hash' typedef for storing passwords using hash functions (MD5, SHA-256, SHA-512) as implemented by the POSIX crypt(3) function, plus YANG features to advertise which hash algorithms an implementation supports.
The 'ietf-system' YANG module provides configuration and state data for system identification, time-of-day management, user authentication, DNS resolver configuration, and system control operations (shutdown, restart, set time) within a NETCONF-managed device.
The NTP client is configured via a presence container /system/ntp (if-feature ntp) containing an 'enabled' boolean and a 'server' list keyed by name; each server entry includes a mandatory UDP address, optional port (if-feature ntp-udp-port, default 123), association-type (server/peer/pool), iburst, and prefer flags.
The RADIUS client is configured under /system/radius (if-feature radius) with a user-ordered server list; each entry includes UDP transport with a mandatory address, authentication-port (default 1812), and a mandatory shared-secret leaf marked nacm:default-deny-all, plus authentication-type (pap or chap, default pap) and global timeout/attempts options.
The timezone choice offers two mutually exclusive cases: 'timezone-name' (if-feature timezone-name, a string from the TZ/Olson Database) or 'timezone-utc-offset' (int16 in minutes, range -1500..1500, no automatic DST adjustment).
Three RPC operations are defined — set-current-datetime (sets /system-state/clock/current-datetime; fails if NTP is active), system-restart (reboots entire system), and system-shutdown (powers off entire system) — all marked nacm:default-deny-all.
User authentication is controlled by the ordered leaf-list /system/authentication/user-authentication-order (identityref, base authentication-method) and the /system/authentication/user list (if-feature local-users) containing per-user name, password (crypt-hash), and authorized-key entries with algorithm and key-data fields for SSH public key authentication.
IANA created an IANA-maintained YANG module 'iana-crypt-hash' (namespace urn:ietf:params:xml:ns:yang:iana-crypt-hash, prefix ianach) to allow new hash algorithms to be added to the crypt-hash type; the registration procedure is Expert Review (RFC 5226).
Two YANG modules are registered in the 'YANG Module Names' registry (RFC 6020): 'iana-crypt-hash' and 'ietf-system' (namespace urn:ietf:params:xml:ns:yang:ietf-system, prefix sys), both referencing RFC 7317. Two corresponding URIs are registered in the IETF XML Registry (RFC 3688).
Because this document uses RADIUS for authentication, implementations are vulnerable to all RADIUS threat scenarios documented in RFC 2865, RFC 3162, and RFC 3579 Section 4, including issues with shared-secret confidentiality and replay attacks.
Several writable data nodes are sensitive: /system/clock/timezone, /system/ntp, /system/dns-resolver, /system/radius, /system/authentication/user-authentication-order, and /system/authentication/user. Unauthorized write access via edit-config can negatively affect network operations; NETCONF ACM (RFC 6536) should be used to restrict write access.
SSH publickey and password authentication configuration is provided; security considerations for these mechanisms are discussed in RFC 4251 Section 9.4 and RFC 4252 Section 11, and implementors must follow those guidelines when using this data model.
The RADIUS shared-secret leaf is marked nacm:default-deny-all to prevent unauthorized read access via NETCONF get or get-config operations, since exposure of the shared secret would compromise the entire RADIUS authentication channel.
The readable nodes /system-state/platform (os-name, os-release, os-version, machine) and /system/authentication/user (including password hashes and SSH key data) can reveal sensitive system and credential information; read access should be controlled via NETCONF ACM.
The three RPC operations (set-current-datetime, system-restart, system-shutdown) are all marked nacm:default-deny-all and are sensitive; unauthorized access could disrupt system operation. All are subject to NETCONF ACM restrictions.
The crypt-hash type encodes passwords in one of four patterns: '$0$<cleartext>' for unencrypted values, '$1$<salt(1-8)>$<hash(22)>' for MD5, '$5$(rounds=N$)?<salt(1-16)>$<hash(43)>' for SHA-256, or '$6$(rounds=N$)?<salt(1-16)>$<hash(86)>' for SHA-512. A '$0$' prefix signals that the server must compute and store the hash on receipt.