Subject: Back to authentication on the IETF network (was: Re: IETF 78: getting to/from/around Maastricht)

From: Chris Elliott <[email-masked]>
Date: Mon, 12 Jul 2010 15:41:50 -0400

We will not be doing 802.1X authentication on any wired ports.

Remember, we really want an open network, while giving people a way of
encrypting their wireless traffic. This time, in preparation for Beijing, we
have the requirement to authenticate that people using the wireless network
are attending the IETF meeting.

I will suggest that in Beijing we may need to physically authenticate people
coming into the terminal room, but I will leave the decision on whether and
how to do that up to the host in Beijing.

Chris.

On Mon, Jul 12, 2010 at 3:22 PM, Iljitsch van Beijnum <[email-masked]>wrote:

> Sorry about my previous message, this was a private message that I
> accidentally sent to the list. The one I really had in mind:
>
> On 12 jul 2010, at 19:53, Chris Elliott wrote:
>
> > I thought we were talking about how to do this for the meeting in
> Maastricht and then in Beijing. I agree that manufacturers could make this
> easier for all of us.
>
> I have no idea where or why this discussion went off the rails (must be the
> heat, note that Maastricht is in the part of the Netherlands that gets the
> warmest in summer) but:
>
> WPA works just fine on anything that rolled out of the factory in the last
> half decade. It's also not particularly hard to use: select network, type
> user name, type password, click "connect" or words to the same effect. There
> is no step 5.
>
> I would even argue that restricting everything to WPA2 and 802.11g or
> better would be entirely reasonable by now.
>
> BTW: do we get 802.1x on the wired ports in the terminal room?
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>

-- 
Chris Elliott
[email-masked]

---

From: Ted Hardie <[email-masked]>
Date: Mon, 12 Jul 2010 12:54:13 -0700

> how to do that up to the host in Beijing.

What does "physically authenticate people" mean here?  Show that they
have a badge (common and meets the stated requirement of "keep the
IETF network for IETF attendees")?  Or write down the name?   Or write
down the name and the network port for the cable they pick up?

The differences here are not subtle, and I don't think this question really
does belong with the hosts in Beijing.  They can present requirements
to the IETF, but it is up to us to decide how to meet them.  If their choice
in meeting the requirement "keep the IETF network for IETF attendees"
turns into "Track the network usage on a per attendee basis", the attendees
really need to know whether that is because that was the real requirement
all along or because the IETF management failed to provide a realistic
alternative that met the stated goal.

best regards,

Ted Hardie

---

From: Chris Elliott <[email-masked]>
Date: Mon, 12 Jul 2010 16:19:36 -0400

> alternative that met the stated goal.

Our requirement in Beijing is to meet the government restriction that only attendees of the meeting can access the Internet through our external link.

There are no requirements for, and we will certainly not be doing, any monitoring of users. Period.

I do not know the layout of the Beijing IETF meeting space. Therefore, I do not know the best approach to securing wired connections in the terminal room and elsewhere. I am suggesting, to be more explicit, that a guard at the door of the terminal room checking that everyone simply has an IETF badge, as we have done in many previous meetings, may be sufficient for Beijing as well, and the easiest solution for all.

And we are working hand-in-hand with the Beijing folks first in Maastricht and then Beijing to refine the requirements and the implementation. Four or five of the folks that will be the core of the NOC team in Beijing are members of the NOC team in Maastricht and will be working with us throughout the meeting. Some of them will be staffing the help desk alongside the RIPE folks, so come by and introduce yourselves.

Our roles will reverse in Beijing as they will be responsible for the network and we will be there to help.

We are well aware of the concerns of IETF attendees around privacy. We share these concerns.

Chris.

---

From: todd glassey <[email-masked]>
Date: Mon, 12 Jul 2010 13:48:09 -0700

On 7/12/2010 1:19 PM, Chris Elliott wrote:
> On Jul 12, 2010, at 3:54 PM, Ted Hardie <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>> On Mon, Jul 12, 2010 at 12:41 PM, Chris Elliott <[email-masked]
>> <mailto:[email-masked]>> wrote:
>>
> Our requirement in Beijing is to meet the government restriction that
> only attendees of the meeting can access the Internet through our
> external link.
>

You wont have to - the Chinese Government and several others will
monitor that for you. You dont believe me - ask the Bureau of State
Security...

>
> I do not know the layout of the Beijing IETF meeting space. Therefore,
> I do not know the best approach to securing wired connections in the
> terminal room and elsewhere. I am suggesting, to be more explicit,
> that a guard at the door of the terminal room checking that everyone
> simply has an IETF badge, as we have done in many previous meetings,
> may be sufficient for Beijing as well, and the easiest solution for all.
Yeah I bet.

Todd
> And we are working hand-in-hand with the Beijing folks first in
> Maastricht and then Beijing to refine the requirements and the
> implementation. Four or five of the folks that will be the core of the
> NOC team in Beijing are members of the NOC team in Maastricht and will
> be working with us throughout the meeting. Some of them will be
> staffing the help desk alongside the RIPE folks, so come by and
> introduce yourselves.
>

---

From: Randy Bush <[email-masked]>
Date: Tue, 13 Jul 2010 06:48:43 +0600

> down the name and the network port for the cable they pick up?

we'll probably never know.  do you know which particular parts of your
traffic at&t gives to the nsa?  modern police states are subtle.

the host provides terminal room security, not net ops.

randy

---

From: Joel Jaeggli <[email-masked]>
Date: Mon, 12 Jul 2010 19:24:00 -0700

> traffic at&t gives to the nsa?  modern police states are subtle.

You can however helpfully self-identify to them by logging into facebook.

> the host provides terminal room security, not net ops.

People with ietf ops clue wrote the following once upon a time which I 
think goes a lot way towards setting our expectations for terminal room 
security (behave strangley and bring your own supply of green dots and 
you should fit right in)

http://tools.ietf.org/html/draft-ymbk-termroom-op-07

    6.1 Physical Security

        Physical security is difficult, with attendees walking in and out
        with laptops and other gear at all hours.  The guards SHOULD be
        told to expect strange things, but to not let large equipment
        walk out without a green badge.  Equipment has been "lost" in the
        past just before, during, or just after an IETF.