Re: [gentoo-hardened] Adding ipv6 USE flag by default

[Michael Orlitzky]

On 02/15/2011 10:52 AM, Alex Efros wrote:
> Hi!
>
> Quick Google and CVE searches shows there was many enough vulnerabilities
> in all OSes (including Linux) IPv6 stack implementations. And, as we all
> know, most of vulnerabilities will be found only after product become
> popular and wide used, which doesn't happens to IPv6 yet.
>
> Keeping this in mind, I think it have sense to avoid enabling IPv6 by
> default on hardened until IPv6 will be wide used/tested/hacked on
> non-hardened systems for some time or until it become critical feature
> required for normal operation on most servers.
>
> This logic is same as for separating ~x86 and x86 profiles - hardened
> profile shouldn't be used to test (for now) useless and potentially
> vulnerable features.
>
>
> P.S. BTW, enabling "ipv6" USE-flag isn't enough. Using dual-stack on
> secure server also mean doubling nearly all network configuration,
> including firewall setup. And while it's well-known how to securely setup
> network for IPv4, it still doesn't clear how to do same for IPv6 - both
> because IPv6 is much more complex and feature-rich, and because there not
> much information/howto available for IPv6 right now. So, I think it have
> sense to prepare some documentation about IPv6-related configuration on
> gentoo site and notify users with `eselect news` mechanism about it before
> enabling default "ipv6" USE-flag in any profile.
>

I tend to agree; it's not like ipv6 is disabled, it's just off by
default. My biggest concern however is for the people who run apache,
postfix, dovecot, etc. with the equivalent of,

  listen = *

who will suddenly be listening on ipv6 addresses (and possibly not know
it) after a recompile. Are all these ipv6-listening services secure? Who
knows, because no one's using them.

The default unconfigured state is probably safe from the network, but I
wouldn't be able to say for sure unless I spent a couple of weeks
bringing myself up to speed on ipv6.