Re: [gentoo-hardened] Adding ipv6 USE flag by default

[Matthew Thode]

I run full dual stacked on my network at home just fine, ip6tables and
filtering at the gateway work for me.  As far as IPV6 specific
vulnerabilities, I think that would be the price to pay (if we decide to go
down this route).

-- Matthew Thode

On Tue, Feb 15, 2011 at 10:52, Alex Efros <powerman@××××××××.name> wrote:

> Hi!
>
> On Fri, Feb 11, 2011 at 06:10:52PM -0500, Anthony G. Basile wrote:
> > >> I don't think there are any issues with it. The only argument I know
> of
> > >> is that it increases the attack surface for a feature that 0% +
> epsilon
> > >> of people use.
> > > Tests done by a colleague show that, right now, the amount of inbound
> ipv6
> > > traffic on his systems is none but I can perfectly understand your
> concerns
> > > even if they should apply only to the network stack itself, as the
> daemons
> > This is precisely the point.  While on the one hand, it has little
> > current use and does potentially increase attack vectors, on the other
> > hand, ipv4 is depleted and ipv6 is on the horizon.
>
> Quick Google and CVE searches shows there was many enough vulnerabilities
> in all OSes (including Linux) IPv6 stack implementations. And, as we all
> know, most of vulnerabilities will be found only after product become
> popular and wide used, which doesn't happens to IPv6 yet.
>
> Keeping this in mind, I think it have sense to avoid enabling IPv6 by
> default on hardened until IPv6 will be wide used/tested/hacked on
> non-hardened systems for some time or until it become critical feature
> required for normal operation on most servers.
>
> This logic is same as for separating ~x86 and x86 profiles - hardened
> profile shouldn't be used to test (for now) useless and potentially
> vulnerable features.
>
>
> P.S. BTW, enabling "ipv6" USE-flag isn't enough. Using dual-stack on
> secure server also mean doubling nearly all network configuration,
> including firewall setup. And while it's well-known how to securely setup
> network for IPv4, it still doesn't clear how to do same for IPv6 - both
> because IPv6 is much more complex and feature-rich, and because there not
> much information/howto available for IPv6 right now. So, I think it have
> sense to prepare some documentation about IPv6-related configuration on
> gentoo site and notify users with `eselect news` mechanism about it before
> enabling default "ipv6" USE-flag in any profile.
>
> --
>                        WBR, Alex.
>
>