Title: Feature Request: Support for Tracking SSH User Identity in NETCONF Sessions and Notifications #546
Description
Description:
We’ve identified a limitation in the current implementation of Netopeer2 and libnetconf2 where SSH user identities are not tracked or exposed in NETCONF session metadata or notifications (e.g., ietf-netconf-notifications).
🔍 Problem Statement
In multi-user environments, it is critical to:
Track which SSH user initiated a NETCONF session.
Include user identity in session-related notifications like netconf-session-start and netconf-session-end.
Enable user-specific auditing and access control.
Currently, all NETCONF sessions appear anonymous from a user identity perspective, which limits traceability and compliance in production environments.
🛠️ Proposed Enhancement
We propose the following:
Extract SSH username during session initiation in libnetconf2 (via libssh).
Store and associate the username with the NETCONF session context.
Expose the username in:
ietf-netconf-notifications session events.
Operational data (e.g., get-session-info RPCs).
Optionally, extend NACM or logging to include user identity.
✅ Benefits
Enables per-user auditing and accountability.
Supports compliance with security policies in enterprise and telecom environments.
Aligns with expectations from ietf-system and ietf-ssh-server modules.
📅 Request
Could you please confirm:
If this feature is already planned or under development?
If not, whether it can be considered for inclusion in an upcoming release?
We’d be happy to contribute or test patches if needed.
Thanks for your continued work on maintaining this excellent NETCONF stack!