Mailing List Archive

On 25/06/2012 12:08, Anthony G. Basile wrote:
> Hi everyone,
>
> We visited this issue during the first ipv6 global day and I asked the
> masses: do you want ipv6 on by default or not. There was lots of back
> and forth and since it was only a question of default, I left the
> status quo, which is off by default.
>
> But now the ipv6 pressures mount! Diego has made a good argument that
> deploying hardened in an ipv6 only environment is a real pita. You
> can't get the goodies you need to bootstrap into an ipv6 only
> environment. With the growth in ipv6, I think it is time.
>
> I'm alerting users so that you can make whatever changes you like to
> ipv6 in your /etc/make.conf. In about 24 hours I will turn on by
> default ipv6 on all hardened profiles.

ACK


There are plenty of reasons to argue for/against, but the big day when
large numbers of servers finally need to be IPV6 aware is coming. Lets
start getting our house in order.

Probably some notes on disabling ipv6 on a given machine would be
helpful, eg:
- iptables6 default drop
- iptables6 reject
- sysctl
- blacklist kernel module or build kernel without support
- kernel command line option (useful when not modular kernel)

Whilst we have the luxury of ipv6 being relatively unprobed and attacks
being relatively unusual and light, lets start getting the groundwork
developed for a default secure gentoo ipv6 system.

Lets switch ipv6 on by default

Cheers

Ed W

On 06/28/2012 07:19 AM, Ed W wrote:
>
> Lets switch ipv6 on by default
>
> Cheers
>
> Ed W

Thanks for your understanding Ed.

ivp6 is now on by default on all hardened profiles.

--
Anthony G. Basile, Ph.D.
Gentoo Linux Developer [Hardened]
E-Mail : blueness@gentoo.org
GnuPG FP : 8040 5A4D 8709 21B1 1A88 33CE 979C AF40 D045 5535
GnuPG ID : D0455535

On 26/06/12 05:03, Alex Efros wrote:
> If I'm right (about creating new security holes because of enabling ipv6
> USE flag) then it may be bad idea to enable it by default until we'll be
> sure admin is ready for this (for example, we may check is IPv6 enabled in
> kernel and is there exists IPv6 firewall rules).

Yes, you are right. Enabling IPv6 is the same as enabling a completely
new protocol. Configuration, routing and firewalls needs to be set up.

But there is an easy way to "opt-out" which could easily be described.
If the default kernel config builds IPv6 support as a module, you can
easily do 'modprobe -r ipv6' and you don't have IPv6 enabled on a
running kernel. This can also be added to the modprobe blacklist as
well, so it's not loaded upon boot. Or for those configuring their own
kernels, disabling the IPv6 module can be another alternative. These
alternatives can easily be documented, IMHO.


kind regards,

David Sommerseth