Re: [gentoo-hardened] ipv6 on by default for hardened profile

[Aaron W. Swenson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 06/27/2012 03:19 AM, Alex Efros wrote:
> Hi!
>
> On Wed, Jun 27, 2012 at 02:33:49AM +0200, Francisco Blas Izquierdo
> Riera (klondike) wrote:
>>> Correct me if I'm wrong, but enabling IPv6 mean needs in
>>> supporting two different routing tables and two different
>>> firewalls.
>> Different routing tables maybe but the firewall is still the
>> same, the iptables based one. And with the ipv6 USE you get it.
>
> By "two different firewalls" I mean needs in supporting two
> different sets of firewall rules, one for iptables and second for
> ip6tables.
>
>> Anyway for this to happen you must (and these are all necessary
>> conditions): * Have an ipv6 route from the attacker to the
>> affected machine * Have ipv6 enable on the kernel. * Have an ipv6
>> address assigned accesible by the attacker. * Get the attacker to
>> know said address (since bruteforcing the address space is hard
>> to say the least). * Have anything listening on that address
>> (depending on the attack the icmpv6 server could be it but there
>> are other services who listen to ipv6 no matter what you do).
>
> I've no idea how many people have IPv6 enabled in kernel
> unintentionally, but all other conditions in many cases will be
> satisfied unintentionally: * route usually exists between two
> machines supporting same protocol * ipv6 address may be
> automatically assigned by ISP by dhcp/ppp * address may be known
> using dns/dyndns, also bruteforcing addresses provided by same ISP
> isn't more complicated than bruteforcing IPv4 addresses, because
> ISP usually provide them in same predictable way * with ipv6 USE
> flag enabled many, if not most, daemons will be listening on IPv6
> address without special configuration by admin
>
> I.e. if you've IPv6 enabled in kernel, and your ISP at some point
> will decide to provide IPv6 addresses, with default USE=ipv6 your
> system and services may become unintentionally accessible by IPv6.
>
> So, only real condition from your list is enable/disable IPv6 in
> kernel.
>
>>> BTW, is there exists (Gentoo?) guides/howtos which explain
>>> these issues (preferably from "differences from IPv4" point of
>>> view) to average admin who know how to setup IPv4 and know
>>> nothing about IPv6, and provide minimum recommended
>>> configuration for IPv6 routing/firewall? I think enabling IPv6
>>> by default should begins from writing such docs.
>> # ip6tables -A INPUT -j DROP # ip6tables -A OUTPUT -j DROP #
>> ip6tables -A FORWARD -j DROP There you are safe now.
>
> Safe, but don't working. Do you enable ipv6 USE flag just to force
> people to either disable unintentionally enabled IPv6 in kernel
> and/or add this ip6tables configuration? I suppose you enable ipv6
> USE flag to make it easier for people to start using IPv6. But to
> use IPv6 these ip6tables rules doesn't helps - we really need docs
> how to setup IPv6 firewall in secure way, written by people who not
> just read IPv6 RFCs, but understood all security implications of
> IPv6-specific features. Last time I tried to google for such docs
> was few years ago, but I found nothing at all.
>

Those who have IPv6 enabled in the kernel unintentionally probably
aren't very security minded and probably aren't using Hardened.
They're moot. We cannot help reckless individuals.

As far as I've seen with the ip6tables, the rules are the same. They
work the same way as iptables. There's just a bit of an accent to some
rules, which is usually the appending of '6',(e.g., icmp6 instead of
icmp).

- -- 
Mr. Aaron W. Swenson
Gentoo Linux Developer
Email    : titanofold@g.o
GnuPG FP : 2C00 7719 4F85 FB07 A49C  0E31 5713 AA03 D1BB FDA0
GnuPG ID : D1BBFDA0


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iF4EAREIAAYFAk/rBHwACgkQVxOqA9G7/aA8mgD/SWOUViEekO2gFkfujne+K/1v
vJNrYSXaq/qEBdmTUj4A/jPU/0lROjqprvZ7YOb+kgYAFVof7OIRs0kEZYiDyI0l
=MCdd
-----END PGP SIGNATURE-----