Re: [gentoo-hardened] ipv6 on by default for hardened profile

[Alex Efros]

Hi!

On Wed, Jun 27, 2012 at 02:33:49AM +0200, Francisco Blas Izquierdo Riera (klondike) wrote:
> > Correct me if I'm wrong, but enabling IPv6 mean needs in supporting two
> > different routing tables and two different firewalls.
> Different routing tables maybe but the firewall is still the same, the
> iptables based one. And with the ipv6 USE you get it.

By "two different firewalls" I mean needs in supporting two different sets
of firewall rules, one for iptables and second for ip6tables.

> Anyway for this to happen you must (and these are all necessary conditions):
> * Have an ipv6 route from the attacker to the affected machine
> * Have ipv6 enable on the kernel.
> * Have an ipv6 address assigned accesible by the attacker.
> * Get the attacker to know said address (since bruteforcing the address
> space is hard to say the least).
> * Have anything listening on that address (depending on the attack the
> icmpv6 server could be it but there are other services who listen to
> ipv6 no matter what you do).

I've no idea how many people have IPv6 enabled in kernel unintentionally,
but all other conditions in many cases will be satisfied unintentionally:
* route usually exists between two machines supporting same protocol
* ipv6 address may be automatically assigned by ISP by dhcp/ppp
* address may be known using dns/dyndns, also bruteforcing addresses
  provided by same ISP isn't more complicated than bruteforcing IPv4
  addresses, because ISP usually provide them in same predictable way
* with ipv6 USE flag enabled many, if not most, daemons will be listening
  on IPv6 address without special configuration by admin

I.e. if you've IPv6 enabled in kernel, and your ISP at some point will
decide to provide IPv6 addresses, with default USE=ipv6 your system and
services may become unintentionally accessible by IPv6.

So, only real condition from your list is enable/disable IPv6 in kernel.

> > BTW, is there exists (Gentoo?) guides/howtos which explain these issues
> > (preferably from "differences from IPv4" point of view) to average admin
> > who know how to setup IPv4 and know nothing about IPv6, and provide
> > minimum recommended configuration for IPv6 routing/firewall? I think
> > enabling IPv6 by default should begins from writing such docs.
> # ip6tables -A INPUT -j DROP
> # ip6tables -A OUTPUT -j DROP
> # ip6tables -A FORWARD -j DROP
> There you are safe now.

Safe, but don't working. Do you enable ipv6 USE flag just to force people
to either disable unintentionally enabled IPv6 in kernel and/or add this
ip6tables configuration? I suppose you enable ipv6 USE flag to make it
easier for people to start using IPv6. But to use IPv6 these ip6tables
rules doesn't helps - we really need docs how to setup IPv6 firewall in
secure way, written by people who not just read IPv6 RFCs, but understood
all security implications of IPv6-specific features. Last time I tried to
google for such docs was few years ago, but I found nothing at all.

-- 
			WBR, Alex.