NACM Recovery Session via TLS ? - Question

[pramodpillaip]

Hi , As per the clarification provide in issue #1125, I understood that that Recovery session is possible via SSH session.

The new question is does Netopeer2 support Recovery session via TLS session ?

Regards Pramod

[michalvasko]

I understood that that Recovery session is possible via SSH session.

I do not know what you gave you that idea, the recovery session is not specific to any transport protocol. You you create a NETCONF session over TLS and the resolved username matches the recovery user UID, it should work.

[pramodpillaip]

I understood that that Recovery session is possible via SSH session.

I do not know what you gave you that idea, the recovery session is not specific to any transport protocol. You you create a NETCONF session over TLS and the resolved username matches the recovery user UID, it should work.

In the file netconf_acm.c the function ncac_getpwnam calls getpwnam_r ( .. ) to get the UID of the user. And I assume that this uid is picked up from /etc/passwd. This made to me to think that it works only for SSH.

Wondering how will this work for TLS session ?

For TLS the username can be embedded in the SubjectAlt name of EndEntity certificate. And the username need not be associated with the Linux user account and hence there need not be a UID associated with it.

[michalvasko]

What you said is true but also what I have replied before, please read it again.