doc: Add RFC documents

1 files changed, 1403 insertions, 0 deletions

diff --git a/doc/rfc/rfc5607.txt b/doc/rfc/rfc5607.txt
new file mode 100644
index 0000000..0d2f0fb
--- /dev/null
+++ b/doc/rfc/rfc5607.txt
@@ -0,0 +1,1403 @@
+
+
+
+
+
+
+Network Working Group                                          D. Nelson
+Request for Comments: 5607                         Elbrys Networks, Inc.
+Category: Standards Track                                       G. Weber
+                                                  Individual Contributor
+                                                               July 2009
+
+
+ Remote Authentication Dial-In User Service (RADIUS) Authorization for
+                 Network Access Server (NAS) Management
+
+Abstract
+
+   This document specifies Remote Authentication Dial-In User Service
+   (RADIUS) attributes for authorizing management access to a Network
+   Access Server (NAS).  Both local and remote management are supported,
+   with granular access rights and management privileges.  Specific
+   provisions are made for remote management via Framed Management
+   protocols and for management access over a secure transport protocol.
+
+Status of This Memo
+
+   This document specifies an Internet standards track protocol for the
+   Internet community, and requests discussion and suggestions for
+   improvements.  Please refer to the current edition of the "Internet
+   Official Protocol Standards" (STD 1) for the standardization state
+   and status of this protocol.  Distribution of this memo is unlimited.
+
+Copyright Notice
+
+   Copyright (c) 2009 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents in effect on the date of
+   publication of this document (http://trustee.ietf.org/license-info).
+   Please review these documents carefully, as they describe your rights
+   and restrictions with respect to this document.
+
+   This document may contain material from IETF Documents or IETF
+   Contributions published or made publicly available before November
+   10, 2008.  The person(s) controlling the copyright in some of this
+   material may not have granted the IETF Trust the right to allow
+   modifications of such material outside the IETF Standards Process.
+   Without obtaining an adequate license from the person(s) controlling
+   the copyright in such materials, this document may not be modified
+   outside the IETF Standards Process, and derivative works of it may
+
+
+
+
+
+Nelson & Weber              Standards Track                     [Page 1]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   not be created outside the IETF Standards Process, except to format
+   it for publication as an RFC or to translate it into languages other
+   than English.
+
+Table of Contents
+
+   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
+   2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  4
+   3.  Overview . . . . . . . . . . . . . . . . . . . . . . . . . . .  4
+   4.  Domain of Applicability  . . . . . . . . . . . . . . . . . . .  5
+   5.  New Values for Existing RADIUS Attributes  . . . . . . . . . .  6
+     5.1.  Service-Type . . . . . . . . . . . . . . . . . . . . . . .6
+   6.  New RADIUS Attributes  . . . . . . . . . . . . . . . . . . . .  6
+     6.1.  Framed-Management-Protocol . . . . . . . . . . . . . . . .  6
+     6.2.  Management-Transport-Protection  . . . . . . . . . . . . . 9
+     6.3.  Management-Policy-Id . . . . . . . . . . . . . . . . . . . 11
+     6.4.  Management-Privilege-Level . . . . . . . . . . . . . . . . 13
+   7.  Use with Dynamic Authorization . . . . . . . . . . . . . . . . 15
+   8.  Examples of Attribute Groupings  . . . . . . . . . . . . . . . 15
+   9.  Diameter Translation Considerations  . . . . . . . . . . . . . 17
+   10. Table of Attributes  . . . . . . . . . . . . . . . . . . . . . 18
+   11. IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 19
+   12. Security Considerations  . . . . . . . . . . . . . . . . . . . 20
+     12.1. General Considerations . . . . . . . . . . . . . . . . . . 20
+     12.2. RADIUS Proxy Operation Considerations  . . . . . . . . . . 22
+   13. Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 23
+   14. References . . . . . . . . . . . . . . . . . . . . . . . . . . 23
+     14.1. Normative References . . . . . . . . . . . . . . . . . . . 23
+     14.2. Informative References . . . . . . . . . . . . . . . . . . 23
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Nelson & Weber              Standards Track                     [Page 2]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+1.  Introduction
+
+   RFC 2865 [RFC2865] defines the NAS-Prompt (7) and Administrative (6)
+   values of the Service-Type (6) Attribute.  Both of these values
+   provide access to the interactive, text-based Command Line Interface
+   (CLI) of the NAS, and were originally developed to control access to
+   the physical console port of the NAS, most often a serial port.
+
+   Remote access to the CLI of the NAS has been available in NAS
+   implementations for many years, using protocols such as Telnet,
+   Rlogin, and the remote terminal service of the Secure SHell (SSH).
+   In order to distinguish local, physical, console access from remote
+   access, the NAS-Port-Type (61) Attribute is generally included in
+   Access-Request and Access-Accept messages, along with the Service-
+   Type (6) Attribute, to indicate the form of access.  A NAS-Port-Type
+   (61) Attribute with a value of Async (0) is used to signify a local
+   serial port connection, while a value of Virtual (5) is used to
+   signify a remote connection, via a remote terminal protocol.  This
+   usage provides no selectivity among the various available remote
+   terminal protocols (e.g., Telnet, Rlogin, SSH, etc.).
+
+   Today, it is common for network devices to support more than the two
+   privilege levels for management access provided by the Service-Type
+   (6) Attribute with values of NAS-Prompt (7) (non-privileged) and
+   Administrative (6) (privileged).  Also, other management mechanisms
+   may be used, such as Web-based management, the Simple Network
+   Management Protocol (SNMP), and the Network Configuration Protocol
+   (NETCONF).  To provide support for these additional features, this
+   specification defines attributes for Framed Management protocols,
+   management protocol security, and management access privilege levels.
+
+   Remote management via the command line is carried over protocols such
+   as Telnet, Rlogin, and the remote terminal service of SSH.  Since
+   these protocols are primarily for the delivery of terminal or
+   terminal emulation services, the term "Framed Management" is used to
+   describe management protocols supporting techniques other than the
+   command line.  Typically, these mechanisms format management
+   information in a binary or textual encoding such as HTML, XML, or
+   ASN.1/BER.  Examples include Web-based management (HTML over HTTP or
+   HTTPS), NETCONF (XML over SSH or BEEP or SOAP), and SNMP (SMI over
+   ASN.1/BER).  Command line interface, menu interface, or other text-
+   based (e.g., ASCII or UTF-8) terminal emulation services are not
+   considered to be Framed Management protocols.
+
+
+
+
+
+
+
+
+Nelson & Weber              Standards Track                     [Page 3]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+2.  Terminology
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+   document are to be interpreted as described in RFC 2119 [RFC2119].
+
+   This document uses terminology from RFC 2865 [RFC2865], RFC 2866
+   [RFC2866], and RFC 5176 [RFC5176].
+
+   The term "integrity protection", as used in this document, is *not*
+   the same as "authentication", as used in SNMP.  Integrity protection
+   requires the sharing of cryptographic keys, but it does not require
+   authenticated principals.  Integrity protection could be used, for
+   example, with anonymous Diffie-Hellman key agreement.  In SNMP, the
+   proof of identity of the principals (authentication) is conflated
+   with tamper-resistance of the protected messages (integrity).  In
+   this document, we assume that integrity protection and authentication
+   are separate concerns.  Authentication is part of the base RADIUS
+   protocol.
+
+   SNMP uses the terms "auth" and "noAuth", as well as "priv" and
+   "noPriv".  There is no analog to auth or noAuth in this document.  In
+   this document, we are assuming that authentication always occurs when
+   it is required, i.e., as a prerequisite to provisioning of access via
+   an Access-Accept packet.
+
+3.  Overview
+
+   To support the authorization and provisioning of Framed Management
+   access to managed entities, this document introduces a new value for
+   the Service-Type (6) Attribute [RFC2865] and one new attribute.  The
+   new value for the Service-Type (6) Attribute is Framed-Management
+   (18), used for remote device management via a Framed Management
+   protocol.  The new attribute is Framed-Management-Protocol (133), the
+   value of which specifies a particular protocol for use in the remote
+   management session.
+
+   Two new attributes are introduced in this document in support of
+   granular management access rights or command privilege levels.  The
+   Management-Policy-Id (135) Attribute provides a text string
+   specifying a policy name of local scope, that is assumed to have been
+   pre-provisioned on the NAS.  This use of an attribute to specify use
+   of a pre-provisioned policy is similar to the Filter-Id (11)
+   Attribute defined in [RFC2865] Section 5.11.
+
+   The local application of the Management-Policy-Id (135) Attribute
+   within the managed entity may take the form of (a) one of an
+   enumeration of command privilege levels, (b) a mapping into an SNMP
+
+
+
+Nelson & Weber              Standards Track                     [Page 4]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   Access Control Model, such as the View-Based Access Control Model
+   (VACM) [RFC3415], or (c) some other set of management access policy
+   rules that is mutually understood by the managed entity and the
+   remote management application.  Examples are given in Section 8.
+
+   The Management-Privilege-Level (136) Attribute contains an integer-
+   valued management privilege level indication.  This attribute serves
+   to modify or augment the management permissions provided by the NAS-
+   Prompt (7) value of the Service-Type (6) Attribute, and thus applies
+   to CLI management.
+
+   To enable management security requirements to be specified, the
+   Management-Transport-Protection (134) Attribute is introduced.  The
+   value of this attribute indicates the minimum level of secure
+   transport protocol protection required for the provisioning of NAS-
+   Prompt (7), Administrative (6), or Framed-Management (18) service.
+
+4.  Domain of Applicability
+
+   Most of the RADIUS attributes defined in this document have broad
+   applicability for provisioning local and remote management access to
+   NAS devices.  However, those attributes that provision remote access
+   over Framed Management protocols and over secure transports have
+   special considerations.  This document does not specify the details
+   of the integration of these protocols with a RADIUS client in the NAS
+   implementation.  However, there are functional requirements for
+   correct application of Framed Management protocols and/or secure
+   transport protocols that will limit the selection of such protocols
+   that can be considered for use with RADIUS.  Since the RADIUS user
+   credentials are typically obtained by the RADIUS client from the
+   secure transport protocol server or the Framed Management protocol
+   server, the protocol, and its implementation in the NAS, MUST support
+   forms of credentials that are compatible with the authentication
+   methods supported by RADIUS.
+
+   RADIUS currently supports the following user authentication methods,
+   although others may be added in the future:
+
+   o  Password - RFC 2865
+
+   o  CHAP (Challenge Handshake Authentication Protocol) - RFC 2865
+
+   o  ARAP (Apple Remote Access Protocol) - RFC 2869
+
+   o  EAP (Extensible Authentication Protocol) - RFC 2869, RFC 3579
+
+   o  HTTP Digest - RFC 5090
+
+
+
+
+Nelson & Weber              Standards Track                     [Page 5]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   The remote management protocols selected for use with the RADIUS
+   remote NAS management sessions, for example, those described in
+   Section 6.1, and the secure transport protocols selected to meet the
+   protection requirements, as described in Section 6.2, obviously need
+   to support user authentication methods that are compatible with those
+   that exist in RADIUS.  The RADIUS authentication methods most likely
+   usable with these protocols are Password, CHAP, and possibly HTTP
+   Digest, with Password being the distinct common denominator.  There
+   are many secure transports that support other, more robust,
+   authentication mechanisms, such as public key.  RADIUS has no support
+   for public key authentication, except within the context of an EAP
+   Method.  The applicability statement for EAP indicates that it is not
+   intended for use as an application-layer authentication mechanism, so
+   its use with the mechanisms described in this document is NOT
+   RECOMMENDED.  In some cases, Password may be the only compatible
+   RADIUS authentication method available.
+
+5.  New Values for Existing RADIUS Attributes
+
+5.1.  Service-Type
+
+   The Service-Type (6) Attribute is defined in Section 5.6 of RFC 2865
+   [RFC2865].  This document defines a new value of the Service-Type
+   Attribute, as follows:
+
+      18   Framed-Management
+
+   The semantics of the Framed-Management service are as follows:
+
+      Framed-Management   A Framed Management protocol session should
+                          be started on the NAS.
+
+6.  New RADIUS Attributes
+
+   This document defines four new RADIUS attributes related to
+   management authorization.
+
+6.1.  Framed-Management-Protocol
+
+   The Framed-Management-Protocol (133) Attribute indicates the
+   application-layer management protocol to be used for Framed
+   Management access.  It MAY be used in both Access-Request and Access-
+   Accept packets.  This attribute is used in conjunction with a
+   Service-Type (6) Attribute with the value of Framed-Management (18).
+
+   It is RECOMMENDED that the NAS include an appropriately valued
+   Framed-Management-Protocol (133) Attribute in an Access-Request
+   packet, indicating the type of management access being requested.  It
+
+
+
+Nelson & Weber              Standards Track                     [Page 6]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   is further RECOMMENDED that the NAS include a Service-Type (6)
+   Attribute with the value Framed-Management (18) in the same Access-
+   Request packet.  The RADIUS server MAY use these attributes as a hint
+   in making its authorization decision.
+
+   The RADIUS server MAY include a Framed-Management-Protocol (133)
+   Attribute in an Access-Accept packet that also includes a Service-
+   Type (6) Attribute with a value of Framed-Management (18), when the
+   RADIUS server chooses to enforce a management access policy for the
+   authenticated user that dictates one form of management access in
+   preference to others.
+
+   When a NAS receives a Framed-Management-Protocol (133) Attribute in
+   an Access-Accept packet, it MUST deliver that specified form of
+   management access or disconnect the session.  If the NAS does not
+   support the provisioned management application-layer protocol, or the
+   management access protocol requested by the user does not match that
+   of the Framed-Management-Protocol (133) Attribute in the Access-
+   Accept packet, the NAS MUST treat the Access-Accept packet as if it
+   had been an Access-Reject.
+
+   A summary of the Framed-Management-Protocol (133) Attribute format is
+   shown below.  The fields are transmitted from left to right.
+
+       0                   1                   2                   3
+       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |     Type      |    Length     |             Value
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+                 Value (cont)         |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+      Type
+
+         133 for Framed-Management-Protocol.
+
+      Length
+
+         6
+
+
+
+
+
+
+
+
+
+
+
+
+Nelson & Weber              Standards Track                     [Page 7]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+      Value
+
+         The Value field is a four-octet enumerated value.
+
+         1      SNMP
+         2      Web-based
+         3      NETCONF
+         4      FTP
+         5      TFTP
+         6      SFTP
+         7      RCP
+         8      SCP
+
+   All other values are reserved for IANA allocation subject to the
+   provisions of Section 11.
+
+   The acronyms used in the above table expand as follows:
+
+   o  SNMP: Simple Network Management Protocol [RFC3411], [RFC3412],
+      [RFC3413], [RFC3414], [RFC3415], [RFC3416], [RFC3417], [RFC3418].
+
+   o  Web-based: Use of an embedded web server in the NAS for management
+      via a generic web browser client.  The interface presented to the
+      administrator may be graphical, tabular, or textual.  The protocol
+      is HTML over HTTP.  The protocol may optionally be HTML over
+      HTTPS, i.e., using HTTP over TLS [HTML] [RFC2616].
+
+   o  NETCONF: Management via the NETCONF protocol using XML over
+      supported transports (e.g., SSH, BEEP, SOAP).  As secure transport
+      profiles are defined for NETCONF, the list of transport options
+      may expand [RFC4741], [RFC4742], [RFC4743], [RFC4744].
+
+   o  FTP: File Transfer Protocol, used to transfer configuration files
+      to and from the NAS [RFC0959].
+
+   o  TFTP: Trivial File Transfer Protocol, used to transfer
+      configuration files to and from the NAS [RFC1350].
+
+   o  SFTP: SSH File Transfer Protocol, used to securely transfer
+      configuration files to and from the NAS.  SFTP uses the services
+      of SSH [SFTP].  See also Section 3.7, "SSH and File Transfers" of
+      [SSH].  Additional information on the "sftp" program may typically
+      be found in the online documentation ("man" pages) of Unix
+      systems.
+
+
+
+
+
+
+
+Nelson & Weber              Standards Track                     [Page 8]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   o  RCP: Remote CoPy file copy utility (Unix-based), used to transfer
+      configuration files to and from the NAS.  See Section 3.7, "SSH
+      and File Transfers", of [SSH].  Additional information on the
+      "rcp" program may typically be found in the online documentation
+      ("man" pages) of Unix systems.
+
+   o  SCP: Secure CoPy file copy utility (Unix-based), used to transfer
+      configuration files to and from the NAS.  The "scp" program is a
+      simple wrapper around SSH.  It's basically a patched BSD Unix
+      "rcp", which uses ssh to do the data transfer (instead of using
+      "rcmd").  See Section 3.7, "SSH and File Transfers", of [SSH].
+      Additional information on the "scp" program may typically be found
+      in the online documentation ("man" pages) of Unix systems.
+
+6.2.  Management-Transport-Protection
+
+   The Management-Transport-Protection (134) Attribute specifies the
+   minimum level of protection that is required for a protected
+   transport used with the Framed or non-Framed Management access
+   session.  The protected transport used by the NAS MAY provide a
+   greater level of protection, but MUST NOT provide a lower level of
+   protection.
+
+   When a secure form of non-Framed Management access is specified, it
+   means that the remote terminal session is encapsulated in some form
+   of protected transport, or tunnel.  It may also mean that an explicit
+   secure mode of operation is required, when the Framed Management
+   protocol contains an intrinsic secure mode of operation.  The
+   Management-Transport-Protection (134) Attribute does not apply to CLI
+   access via a local serial port, or other non-remote connection.
+
+   When a secure form of Framed Management access is specified, it means
+   that the application-layer management protocol is encapsulated in
+   some form of protected transport, or tunnel.  It may also mean that
+   an explicit secure mode of operation is required, when the Framed
+   Management protocol contains an intrinsic secure mode of operation.
+
+   A value of "No Protection (1)" indicates that a secure transport
+   protocol is not required, and that the NAS SHOULD accept a connection
+   over any transport associated with the application-layer management
+   protocol.  The definitions of management application to transport
+   bindings are defined in the relevant documents that specify those
+   management application protocols.  The same "No Protection" semantics
+   are conveyed by omitting this attribute from an Access-Accept packet.
+
+   Specific protected transport protocols, cipher suites, key agreement
+   methods, or authentication methods are not specified by this
+   attribute.  Such provisioning is beyond the scope of this document.
+
+
+
+Nelson & Weber              Standards Track                     [Page 9]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   It is RECOMMENDED that the NAS include an appropriately valued
+   Management-Transport-Protection (134) Attribute in an Access-Request
+   packet, indicating the level of transport protection for the
+   management access being requested, when that information is available
+   to the RADIUS client.  The RADIUS server MAY use this attribute as a
+   hint in making its authorization decision.
+
+   The RADIUS server MAY include a Management-Transport-Protection (134)
+   Attribute in an Access-Accept packet that also includes a Service-
+   Type (6) Attribute with a value of Framed-Management (18), when the
+   RADIUS server chooses to enforce a management access security policy
+   for the authenticated user that dictates a minimum level of transport
+   security.
+
+   When a NAS receives a Management-Transport-Protection (134) Attribute
+   in an Access-Accept packet, it MUST deliver the management access
+   over a transport with equal or better protection characteristics or
+   disconnect the session.  If the NAS does not support protected
+   management transport protocols, or the level of protection available
+   does not match that of the Management-Transport-Protection (134)
+   Attribute in the Access-Accept packet, the NAS MUST treat the
+   response packet as if it had been an Access-Reject.
+
+   A summary of the Management-Transport-Protection (134) Attribute
+   format is shown below.  The fields are transmitted from left to
+   right.
+
+       0                   1                   2                   3
+       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      |     Type      |    Length     |             Value
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+                 Value (cont)         |
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+      Type
+
+         134 for Management-Transport-Protection.
+
+      Length
+
+         6
+
+
+
+
+
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 10]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+      Value
+
+         The Value field is a four-octet enumerated value.
+
+         1      No-Protection
+         2      Integrity-Protection
+         3      Integrity-Confidentiality-Protection
+
+   All other values are reserved for IANA allocation subject to the
+   provisions of Section 11.
+
+   The names used in the above table are elaborated as follows:
+
+   o  No-Protection: No transport protection is required.  Accept
+      connections via any supported transport.
+
+   o  Integrity-Protection: The management transport MUST provide
+      Integrity Protection, i.e., protection from unauthorized
+      modification, using a cryptographic checksum.
+
+   o  Integrity-Confidentiality-Protection: The management transport
+      MUST provide both Integrity Protection and Confidentiality
+      Protection, i.e., protection from unauthorized modification, using
+      a cryptographic checksum, and protection from unauthorized
+      disclosure, using encryption.
+
+   The configuration or negotiation of acceptable algorithms, modes, and
+   credentials for the cryptographic protection mechanisms used in
+   implementing protected management transports is outside the scope of
+   this document.  Many such mechanisms have standardized methods of
+   configuration and key management.
+
+6.3.  Management-Policy-Id
+
+   The Management-Policy-Id (135) Attribute indicates the name of the
+   management access policy for this user.  Zero or one Management-
+   Policy-Id (135) Attributes MAY be sent in an Access-Accept packet.
+   Identifying a policy by name allows the policy to be used on
+   different NASes without regard to implementation details.
+
+   Multiple forms of management access rules may be expressed by the
+   underlying named policy, the definition of which is beyond the scope
+   of this document.  The management access policy MAY be applied
+   contextually, based on the nature of the management access method.
+   For example, some named policies may only be valid for application to
+   NAS-Prompt (7) services and some other policies may only be valid for
+   SNMP.
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 11]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   The management access policy named in this attribute, received in an
+   Access-Accept packet, MUST be applied to the session authorized by
+   the Access-Accept.  If the NAS supports this attribute, but the
+   policy name is unknown, or if the RADIUS client is able to determine
+   that the policy rules are incorrectly formatted, the NAS MUST treat
+   the Access-Accept packet as if it had been an Access-Reject.
+
+   No precedence relationship is defined for multiple occurrences of the
+   Management-Policy-Id (135) Attribute.  NAS behavior in such cases is
+   undefined.  Therefore, two or more occurrences of this attribute
+   SHOULD NOT be included in an Access-Accept or CoA-Request (Change-of-
+   Authorization).  In the absence of further specification defining
+   some sort of precedence relationship, it is not possible to guarantee
+   multi-vendor interoperability when using multiple instances of this
+   attribute in a single Access-Accept or CoA-Request packet.
+
+   The content of the Management-Policy-Id (135) Attribute is expected
+   to be the name of a management access policy of local significance to
+   the NAS, within a namespace of significance to the NAS.  In this
+   regard, the behavior is similar to that for the Filter-Id (11)
+   Attribute.  The policy names and rules are committed to the local
+   configuration data-store of the NAS, and are provisioned by means
+   beyond the scope of this document, such as via SNMP, NETCONF, or CLI.
+
+   The namespace used in the Management-Policy-Id (135) Attribute is
+   simple and monolithic.  There is no explicit or implicit structure or
+   hierarchy.  For example, in the text string "example.com", the "."
+   (period or dot) is just another character.  It is expected that text
+   string matching will be performed without parsing the text string
+   into any sub-fields.
+
+   Overloading or subdividing this simple name with multi-part
+   specifiers (e.g., Access=remote, Level=7) is likely to lead to poor
+   multi-vendor interoperability and SHOULD NOT be utilized.  If a
+   simple, unstructured policy name is not sufficient, it is RECOMMENDED
+   that a Vendor Specific (26) Attribute be used instead, rather than
+   overloading the semantics of Management-Policy-Id.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 12]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   A summary of the Management-Policy-Id (135) Attribute format is shown
+   below.  The fields are transmitted from left to right.
+
+       0                   1                   2
+       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
+      |     Type      |    Length     |  Text ...
+      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
+
+      Type
+
+         135 for Management-Policy-Id.
+
+      Length
+
+         >= 3
+
+      Text
+
+         The Text field is one or more octets, and its contents are
+         implementation dependent.  It is intended to be human
+         readable and the contents MUST NOT be parsed by the receiver;
+         the contents can only be used to look up locally defined
+         policies.  It is RECOMMENDED that the message contain UTF-8
+         encoded 10646 [RFC3629] characters.
+
+6.4.  Management-Privilege-Level
+
+   The Management-Privilege-Level (136) Attribute indicates the integer-
+   valued privilege level to be assigned for management access for the
+   authenticated user.  Many NASes provide the notion of differentiated
+   management privilege levels denoted by an integer value.  The
+   specific access rights conferred by each value are implementation
+   dependent.  It MAY be used in both Access-Request and Access-Accept
+   packets.
+
+   The mapping of integer values for this attribute to specific
+   collections of management access rights or permissions on the NAS is
+   vendor and implementation specific.  Such mapping is often a user-
+   configurable feature.  It's RECOMMENDED that greater numeric values
+   imply greater privilege.  However, it would be a mistake to assume
+   that this recommendation always holds.
+
+   The management access level indicated in this attribute, received in
+   an Access-Accept packet, MUST be applied to the session authorized by
+   the Access-Accept.  If the NAS supports this attribute, but the
+   privilege level is unknown, the NAS MUST treat the Access-Accept
+   packet as if it had been an Access-Reject.
+
+
+
+Nelson & Weber              Standards Track                    [Page 13]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   A summary of the Management-Privilege-Level (136) Attribute format is
+   show below.  The fields are transmitted from left to right.
+
+
+        0                   1                   2                   3
+        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+       |     Type      |    Length     |             Value
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+                  Value (cont)         |
+       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+       Type
+
+          136 for Management-Privilege-Level.
+
+       Length
+
+          6
+
+       Value
+
+          The Value field is a four-octet Integer, denoting a management
+          privilege level.
+
+
+   It is RECOMMENDED to limit use of the Management-Privilege-Level
+   (136) Attribute to sessions where the Service-Type (6) Attribute has
+   a value of NAS-Prompt (7) (not Administrative).  Typically, NASes
+   treat NAS-Prompt as the minimal privilege CLI service and
+   Administrative as full privilege.  Using the Management-Privilege-
+   Level (136) Attribute with a Service-Type (6) Attribute having a
+   value of NAS-Prompt (7) will have the effect of increasing the
+   minimum privilege level.  Conversely, it is NOT RECOMMENDED to use
+   this attribute with a Service-Type (6) Attribute with a value of
+   Administrative (6), which may require decreasing the maximum
+   privilege level.
+
+   It is NOT RECOMMENDED to use the Management-Privilege-Level (136)
+   Attribute in combination with a Management-Policy-Id (135) Attribute
+   or for management access methods other than interactive CLI.  The
+   behavior resulting from such an overlay of management access control
+   provisioning is not defined by this document, and in the absence of
+   further specification, is likely to lead to unexpected behaviors,
+   especially in multi-vendor environments.
+
+
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 14]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+7.  Use with Dynamic Authorization
+
+   It is entirely OPTIONAL for the NAS management authorization
+   attributes specified in this document to be used in conjunction with
+   Dynamic Authorization extensions to RADIUS [RFC5176].  When such
+   usage occurs, those attributes MAY be used as listed in the Table of
+   Attributes in Section 10.
+
+   Some guidance on how to identify existing management sessions on a
+   NAS for the purposes of Dynamic Authorization is useful.  The primary
+   session identifiers SHOULD be User-Name (1) and Service-Type (6).  To
+   accommodate instances when that information alone does not uniquely
+   identify a session, a NAS supporting Dynamic Authorization SHOULD
+   maintain one or more internal session identifiers that can be
+   represented as RADIUS attributes.  Examples of such attributes
+   include Acct-Session-Id (44), Acct-Multi-Session-Id (50), NAS-Port
+   (5), or NAS-Port-Id (87).  In the case of a remote management
+   session, common identifier values might include things such as the
+   remote IP address and remote TCP port number, or the file descriptor
+   value for use with the open socket.  Any such identifier is obviously
+   transient in nature, and implementations SHOULD take care to avoid
+   and/or properly handle duplicate or stale values.
+
+   In order for the session identification attributes to be available to
+   the Dynamic Authorization Client, a NAS supporting Dynamic
+   Authorization for management sessions SHOULD include those session
+   identification attributes in the Access-Request message for each such
+   session.  Additional discussion of session identification attribute
+   usage may be found in Section 3 of [RFC5176].
+
+8.  Examples of Attribute Groupings
+
+   1.  Unprotected CLI access, via the local console, to the "super-
+       user" access level:
+
+       *  Service-Type (6) = Administrative (6)
+
+       *  NAS-Port-Type (61) = Async (0)
+
+       *  Management-Transport-Protection (134) = No-Protection (1)
+
+   2.  Unprotected CLI access, via a remote console, to the "super-user"
+       access level:
+
+       *  Service-Type (6) = Administrative (6)
+
+       *  NAS-Port-Type (61) = Virtual (5)
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 15]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+       *  Management-Transport-Protection (134) = No-Protection (1)
+
+   3.  CLI access, via a fully protected secure remote terminal service
+       to the non-privileged user access level:
+
+       *  Service-Type (6) = NAS-Prompt (7)
+
+       *  NAS-Port-Type (61) = Virtual (5)
+
+       *  Management-Transport-Protection (134) = Integrity-
+          Confidentiality-Protection (3)
+
+   4.  CLI access, via a fully protected secure remote terminal service,
+       to a custom management access level, defined by a policy:
+
+       *  Service-Type (6) = NAS-Prompt (7)
+
+       *  NAS-Port-Type (61) = Virtual (5)
+
+       *  Management-Transport-Protection (134) = Integrity-
+          Confidentiality-Protection (3)
+
+       *  Management-Policy-Id (135) = "Network Administrator"
+
+   5.  CLI access, via a fully protected secure remote terminal service,
+       with a management privilege level of 15:
+
+       *  Service-Type (6) = NAS-Prompt (7)
+
+       *  NAS-Port-Type (61) = Virtual (5)
+
+       *  Management-Transport-Protection (134) = Integrity-
+          Confidentiality-Protection (3)
+
+       *  Management-Privilege-Level (136) = 15
+
+   6.  SNMP access, using an Access Control Model specifier, such as a
+       custom VACM View, defined by a policy:
+
+       *  Service-Type (6) = Framed-Management (18)
+
+       *  NAS-Port-Type (61) = Virtual (5)
+
+       *  Framed-Management-Protocol (133) = SNMP (1)
+
+       *  Management-Policy-Id (135) = "SNMP Network Administrator View"
+
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 16]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+       There is currently no standardized way of implementing this
+       management policy mapping within SNMP.  Such mechanisms are the
+       topic of current research.
+
+   7.  SNMP fully protected access:
+
+       *  Service-Type (6) = Framed-Management (18)
+
+       *  NAS-Port-Type (61) = Virtual (5)
+
+       *  Framed-Management-Protocol (133) = SNMP (1)
+
+       *  Management-Transport-Protection (134) = Integrity-
+          Confidentiality-Protection (3)
+
+   8.  Web (HTTP/HTML) access:
+
+       *  Service-Type (6) = Framed-Management (18)
+
+       *  NAS-Port-Type (61) = Virtual (5)
+
+       *  Framed-Management-Protocol (133) = Web-based (2)
+
+   9.  Secure web access, using a custom management access level,
+       defined by a policy:
+
+       *  Service-Type (6) = Framed-Management (18)
+
+       *  NAS-Port-Type (61) = Virtual (5)
+
+       *  Framed-Management-Protocol (133) = Web-based (2)
+
+       *  Management-Transport-Protection (134) = Integrity-
+          Confidentiality-Protection (3)
+
+       *  Management-Policy-Id (135) = "Read-only web access"
+
+9.  Diameter Translation Considerations
+
+   When used in Diameter, the attributes defined in this specification
+   can be used as Diameter attribute-value pairs (AVPs) from the Code
+   space 1-255 (RADIUS attribute compatibility space).  No additional
+   Diameter Code values are therefore allocated.  The data types and
+   flag rules for the attributes are as follows:
+
+
+
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 17]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+                                    +---------------------+
+                                    |    AVP Flag rules   |
+                                    |----+-----+----+-----|----+
+                                    |    |     SHOULD MUST|    |
+   Attribute Name        Value Type |MUST| MAY | NOT|  NOT|Encr|
+   ---------------------------------|----+-----+----+-----|----|
+   Service-Type                     |    |     |    |     |    |
+                         Enumerated | M  |  P  |    |  V  | Y  |
+   Framed-Management-Protocol       |    |     |    |     |    |
+                         Enumerated | M  |  P  |    |  V  | Y  |
+   Management-Transport-Protection  |    |     |    |     |    |
+                         Enumerated | M  |  P  |    |  V  | Y  |
+   Management-Policy-Id             |    |     |    |     |    |
+                         UTF8String | M  |  P  |    |  V  | Y  |
+   Management-Privilege-Level       |    |     |    |     |    |
+                         Integer    | M  |  P  |    |  V  | Y  |
+   ---------------------------------|----+-----+----+-----|----|
+
+   The attributes in this specification have no special translation
+   requirements for Diameter to RADIUS or RADIUS to Diameter gateways;
+   they are copied as is, except for changes relating to headers,
+   alignment, and padding.  See also [RFC3588], Section 4.1, and
+   [RFC4005], Section 9.
+
+   What this specification says about the applicability of the
+   attributes for RADIUS Access-Request packets applies in Diameter to
+   AA-Request [RFC4005].
+
+   What is said about Access-Accept applies in Diameter to AA-Answer
+   messages that indicate success.
+
+10.  Table of Attributes
+
+   The following table provides a guide to which attributes may be found
+   in which kinds of packets, and in what quantity.
+
+   Access Messages
+   Request Accept Reject Challenge  #     Attribute
+   ---------------------------------------------------------------------
+   0-1     0-1      0        0     133   Framed-Management-Protocol
+   0-1     0-1      0        0     134   Management-Transport-Protection
+   0       0-1      0        0     135   Management-Policy-Id
+   0       0-1      0        0     136   Management-Privilege-Level
+
+
+
+
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 18]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   Accounting Messages
+   Request Response   #     Attribute
+   ---------------------------------------------------------------------
+   0-1     0         133   Framed-Management-Protocol
+   0-1     0         134   Management-Transport-Protection
+   0-1     0         135   Management-Policy-Id
+   0-1     0         136   Management-Privilege-Level
+
+
+
+   Change-of-Authorization Messages
+   Request  ACK   NAK   #     Attribute
+   --------------------------------------------------------------------
+   0       0     0     133   Framed-Management-Protocol
+   0       0     0     134   Management-Transport-Protection
+   0-1     0     0     135   Management-Policy-Id (Note 1)
+   0-1     0     0     136   Management-Privilege-Level (Note 1)
+
+
+   Disconnect Messages
+   Request  ACK   NAK   #     Attribute
+   ---------------------------------------------------------------------
+   0        0     0     133   Framed-Management-Protocol
+   0        0     0     134   Management-Transport-Protection
+   0        0     0     135   Management-Policy-Id
+   0        0     0     136   Management-Privilege-Level
+
+   (Note 1) When included within a CoA-Request, these attributes
+     represent an authorization change request.  When one of these
+     attributes is omitted from a CoA-Request, the NAS assumes that the
+     attribute value is to remain unchanged.  Attributes included in a
+     CoA-Request replace all existing values of the same attribute(s).
+
+   The following table defines the meaning of the above table entries.
+
+       0    This attribute MUST NOT be present in a packet.
+       0+   Zero or more instances of this attribute MAY be present in
+            a packet.
+       0-1  Zero or one instance of this attribute MAY be present in
+            a packet.
+       1    Exactly one instance of this attribute MUST be present in
+            a packet.
+
+11.  IANA Considerations
+
+   The following numbers have been assigned in the RADIUS Attribute
+   Types registry.
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 19]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   o  New enumerated value for the existing Service-Type Attribute:
+
+      *  Framed-Management (18)
+
+   o  New RADIUS Attribute Types:
+
+      *  Framed-Management-Protocol (133)
+
+      *  Management-Transport-Protection (134)
+
+      *  Management-Policy-Id (135)
+
+      *  Management-Privilege-Level (136)
+
+   The enumerated values of the newly assigned RADIUS Attribute Types as
+   defined in this document were assigned at the same time as the new
+   Attribute Types.
+
+   For the Framed-Management-Protocol Attribute:
+
+         1      SNMP
+         2      Web-based
+         3      NETCONF
+         4      FTP
+         5      TFTP
+         6      SFTP
+         7      RCP
+         8      SCP
+
+   For the Management-Transport-Protection Attribute:
+
+         1      No-Protection
+         2      Integrity-Protection
+         3      Integrity-Confidentiality-Protection
+
+   Assignments of additional enumerated values for the RADIUS attributes
+   defined in this document are to be processed as described in
+   [RFC3575], subject to the additional requirement of a published
+   specification.
+
+12.  Security Considerations
+
+12.1.  General Considerations
+
+   This specification describes the use of RADIUS and Diameter for
+   purposes of authentication, authorization, and accounting for
+   management access to devices within networks.  RADIUS threats and
+   security issues for this application are described in [RFC3579] and
+
+
+
+Nelson & Weber              Standards Track                    [Page 20]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   [RFC3580]; security issues encountered in roaming are described in
+   [RFC2607].  For Diameter, the security issues relating to this
+   application are described in [RFC4005] and [RFC4072].
+
+   This document specifies new attributes that can be included in
+   existing RADIUS packets, which may be protected as described in
+   [RFC3579] and [RFC5176].  In Diameter, the attributes are protected
+   as specified in [RFC3588].  See those documents for a more detailed
+   description.
+
+   The security mechanisms supported in RADIUS and Diameter are focused
+   on preventing an attacker from spoofing packets or modifying packets
+   in transit.  They do not prevent an authorized RADIUS/Diameter server
+   or proxy from inserting attributes with malicious intent.
+
+   A legacy NAS may not recognize the attributes in this document that
+   supplement the provisioning of CLI management access.  If the value
+   of the Service-Type Attribute is NAS-Prompt or Administrative, the
+   legacy NAS may silently discard such attributes, while permitting the
+   user to access the CLI management interface(s) of the NAS.  This can
+   lead to users improperly receiving authorized management access to
+   the NAS, or access with greater levels of access rights than were
+   intended.  RADIUS servers SHOULD attempt to ascertain whether or not
+   the NAS supports these attributes before sending them in an Access-
+   Accept message that provisions CLI access.
+
+   It is possible that certain NAS implementations may not be able to
+   determine the protection properties of the underlying transport
+   protocol as specified by the Management-Transport-Protection
+   Attribute.  This may be a limitation of the standard application
+   programming interface of the underlying transport implementation or
+   of the integration of the transport into the NAS implementation.  In
+   either event, NASes conforming to this specification, which cannot
+   determine the protection state of the remote management connection,
+   MUST treat an Access-Accept message containing a Management-
+   Transport-Protection Attribute containing a value other than No-
+   Protection (1) as if it were an Access-Reject message, unless
+   specifically overridden by local policy configuration.
+
+   Use of the No-Protection (1) option for the Management-Transport-
+   Protection (134) Attribute is NOT RECOMMENDED in any deployment where
+   secure management or configuration is required.
+
+
+
+
+
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 21]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+12.2.  RADIUS Proxy Operation Considerations
+
+   The device management access authorization attributes presented in
+   this document present certain considerations when used in RADIUS
+   proxy environments.  These considerations are not different from
+   those that exist in RFC 2865 [RFC2865] with respect to the Service-
+   Type Attribute values of Administrative and NAS-Prompt.
+
+   Most RADIUS proxy environments are also multi-party environments.  In
+   multi-party proxy environments it is important to distinguish which
+   entities have the authority to provision management access to the
+   edge devices, i.e., NASes, and which entities only have authority to
+   provision network access services of various sorts.
+
+   It may be important that operators of the NAS are able to ensure that
+   access to the CLI, or other management interfaces of the NAS, is only
+   provisioned to their own employees or contractors.  One way for the
+   NAS to enforce this requirement is to use only local, non-proxy
+   RADIUS servers for management access requests.  Proxy RADIUS servers
+   could be used for non-management access requests, based on local
+   policy.  This "bifurcation" of RADIUS authentication and
+   authorization is a simple case of separate administrative realms.
+   The NAS may be designed so as to maintain separate lists of RADIUS
+   servers for management AAA use and for non-management AAA use.
+
+   An alternate method of enforcing this requirement would be for the
+   first-hop RADIUS proxy server, operated by the owner of the NAS, to
+   filter out any RADIUS attributes that provision management access
+   rights that originate from "up-stream" proxy servers not operated by
+   the NAS owner.  Access-Accept messages that provision such locally
+   unauthorized management access MAY be treated as if they were an
+   Access-Reject by the first-hop proxy server.
+
+   An additional exposure present in proxy deployments is that sensitive
+   user credentials, e.g., passwords, are likely to be available in
+   cleartext form at each of the proxy servers.  Encrypted or hashed
+   credentials are not subject to this risk, but password authentication
+   is a very commonly used mechanism for management access
+   authentication, and in RADIUS passwords are only protected on a hop-
+   by-hop basis.  Malicious proxy servers could misuse this sensitive
+   information.
+
+   These issues are not of concern when all the RADIUS servers, local
+   and proxy, used by the NAS are under the sole administrative control
+   of the NAS owner.
+
+
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 22]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+13.  Acknowledgments
+
+   Many thanks to all reviewers, including Bernard Aboba, Alan DeKok,
+   David Harrington, Mauricio Sanchez, Juergen Schoenwaelder, Hannes
+   Tschofenig, Barney Wolff, and Glen Zorn.
+
+14.  References
+
+14.1.  Normative References
+
+   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
+              Requirement Levels", BCP 14, RFC 2119, March 1997.
+
+   [RFC2865]  Rigney, C., Willens, S., Rubens, A., and W. Simpson,
+              "Remote Authentication Dial In User Service (RADIUS)",
+              RFC 2865, June 2000.
+
+   [RFC3629]  Yergeau, F., "UTF-8, a transformation format of ISO
+              10646", STD 63, RFC 3629, November 2003.
+
+14.2.  Informative References
+
+   [HTML]     Raggett, D., Le Hors, A., and I. Jacobs, "The HTML 4.01
+              Specification, W3C", December 1999.
+
+   [RFC0959]  Postel, J. and J. Reynolds, "File Transfer Protocol",
+              STD 9, RFC 959, October 1985.
+
+   [RFC1350]  Sollins, K., "The TFTP Protocol (Revision 2)", STD 33,
+              RFC 1350, July 1992.
+
+   [RFC2607]  Aboba, B. and J. Vollbrecht, "Proxy Chaining and Policy
+              Implementation in Roaming", RFC 2607, June 1999.
+
+   [RFC2616]  Fielding, R., Gettys, J., Mogul, J., Frystyk, H.,
+              Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext
+              Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.
+
+   [RFC2866]  Rigney, C., "RADIUS Accounting", RFC 2866, June 2000.
+
+   [RFC3411]  Harrington, D., Presuhn, R., and B. Wijnen, "An
+              Architecture for Describing Simple Network Management
+              Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
+              December 2002.
+
+
+
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 23]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   [RFC3412]  Case, J., Harrington, D., Presuhn, R., and B. Wijnen,
+              "Message Processing and Dispatching for the Simple Network
+              Management Protocol (SNMP)", STD 62, RFC 3412,
+              December 2002.
+
+   [RFC3413]  Levi, D., Meyer, P., and B. Stewart, "Simple Network
+              Management Protocol (SNMP) Applications", STD 62,
+              RFC 3413, December 2002.
+
+   [RFC3414]  Blumenthal, U. and B. Wijnen, "User-based Security Model
+              (USM) for version 3 of the Simple Network Management
+              Protocol (SNMPv3)", STD 62, RFC 3414, December 2002.
+
+   [RFC3415]  Wijnen, B., Presuhn, R., and K. McCloghrie, "View-based
+              Access Control Model (VACM) for the Simple Network
+              Management Protocol (SNMP)", STD 62, RFC 3415,
+              December 2002.
+
+   [RFC3416]  Presuhn, R., "Version 2 of the Protocol Operations for the
+              Simple Network Management Protocol (SNMP)", STD 62,
+              RFC 3416, December 2002.
+
+   [RFC3417]  Presuhn, R., "Transport Mappings for the Simple Network
+              Management Protocol (SNMP)", STD 62, RFC 3417,
+              December 2002.
+
+   [RFC3418]  Presuhn, R., "Management Information Base (MIB) for the
+              Simple Network Management Protocol (SNMP)", STD 62,
+              RFC 3418, December 2002.
+
+   [RFC3575]  Aboba, B., "IANA Considerations for RADIUS (Remote
+              Authentication Dial In User Service)", RFC 3575,
+              July 2003.
+
+   [RFC3579]  Aboba, B. and P. Calhoun, "RADIUS (Remote Authentication
+              Dial In User Service) Support For Extensible
+              Authentication Protocol (EAP)", RFC 3579, September 2003.
+
+   [RFC3580]  Congdon, P., Aboba, B., Smith, A., Zorn, G., and J. Roese,
+              "IEEE 802.1X Remote Authentication Dial In User Service
+              (RADIUS) Usage Guidelines", RFC 3580, September 2003.
+
+   [RFC3588]  Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J.
+              Arkko, "Diameter Base Protocol", RFC 3588, September 2003.
+
+   [RFC4005]  Calhoun, P., Zorn, G., Spence, D., and D. Mitton,
+              "Diameter Network Access Server Application", RFC 4005,
+              August 2005.
+
+
+
+Nelson & Weber              Standards Track                    [Page 24]
+
+RFC 5607          RADIUS NAS-Management Authorization          July 2009
+
+
+   [RFC4072]  Eronen, P., Hiller, T., and G. Zorn, "Diameter Extensible
+              Authentication Protocol (EAP) Application", RFC 4072,
+              August 2005.
+
+   [RFC4741]  Enns, R., "NETCONF Configuration Protocol", RFC 4741,
+              December 2006.
+
+   [RFC4742]  Wasserman, M. and T. Goddard, "Using the NETCONF
+              Configuration Protocol over Secure SHell (SSH)", RFC 4742,
+              December 2006.
+
+   [RFC4743]  Goddard, T., "Using NETCONF over the Simple Object Access
+              Protocol (SOAP)", RFC 4743, December 2006.
+
+   [RFC4744]  Lear, E. and K. Crozier, "Using the NETCONF Protocol over
+              the Blocks Extensible Exchange Protocol (BEEP)", RFC 4744,
+              December 2006.
+
+   [RFC5176]  Chiba, M., Dommety, G., Eklund, M., Mitton, D., and B.
+              Aboba, "Dynamic Authorization Extensions to Remote
+              Authentication Dial In User Service (RADIUS)", RFC 5176,
+              January 2008.
+
+   [SFTP]     Galbraith, J. and O. Saarenmaa, "SSH File Transfer
+              Protocol", Work in Progress, July 2006.
+
+   [SSH]      Barrett, D., Silverman, R., and R. Byrnes, "SSH, the
+              Secure Shell: The Definitive Guide, Second Edition,
+              O'Reilly and Associates", May 2005.
+
+Authors' Addresses
+
+   David B. Nelson
+   Elbrys Networks, Inc.
+   282 Corporate Drive
+   Portsmouth, NH  03801
+   USA
+
+   EMail: dnelson@elbrysnetworks.com
+
+
+   Greg Weber
+   Individual Contributor
+   Knoxville, TN  37932
+   USA
+
+   EMail: gdweber@gmail.com
+
+
+
+
+Nelson & Weber              Standards Track                    [Page 25]
+