If you got scared, why not keep the entire network down? If you want it, sure you can enable it ;-)
Enjoy your weekend.
-----Original Message----- From: users-bounces@lists.fedoraproject.org [mailto:users-bounces@lists.fedoraproject.org] On Behalf Of Fernando Lozano Sent: Friday, July 12, 2013 5:50 PM To: users@lists.fedoraproject.org Subject: Proposal: Fedora should install with NETWORK [was IPv6] disabled by default [was: Re: Disabling ipv6]
Hi Chris,
[As I changed the subject, let me clear: NETWORK [was: IPv6] still compiled in the kernel. Just the network interfaces configs that should come with NETWORK [was:IPv6] disabled by default, if the user wants it should be easy to enable]
______________________________________________________________________ Dit bericht kan informatie bevatten die niet voor u is bestemd. Indien u niet de geadresseerde bent of dit bericht abusievelijk aan u is toegezonden, wordt u verzocht dat aan de afzender te melden en het bericht te verwijderen. De Staat aanvaardt geen aansprakelijkheid voor schade, van welke aard ook, die verband houdt met risico's verbonden aan het electronisch verzenden van berichten.
This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. The State accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.
On Fri, 12 Jul 2013, J.Witvliet@mindef.nl wrote:
If you got scared, why not keep the entire network down? If you want it, sure you can enable it ;-)
That is what I do. If I'm using my computer and need internet access, I just click on the start-listening icon. Said icon then becomes a stop-listening icon.
Hi,
If you got scared, why not keep the entire network down? If you want it, sure you can enable it ;-)
By your reasoning, Fedora doesn't need to provide secure installation defaults. Anyone could craft their own iptables rules and selinux policies if they feed a need for better security. And by the way, why having trouble provinding services pre-packaged using chroot?
[]s, Fernando Lozano
this is childish
there is a difference between well aware ipv4 and all sorts of firewalls and proctections configured or startup in a network with ipv6 enabled without knowing it or not configured at all
coming up with a "link-local" address inside a network which is *pure ipv4* on a server means *any* random device which does the same may bypass all your firewall rule ssince iptables and ip6tables are two different services
F17/F18: eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1472 inet 10.0.0.103 netmask 255.255.255.0 broadcast 10.0.0.255 ether 00:50:56:bd:00:17 txqueuelen 1000 (Ethernet) RX packets 3131400 bytes 582391690 (555.4 MiB) RX errors 0 dropped 1428 overruns 0 frame 0 TX packets 2548626 bytes 6720733855 (6.2 GiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 _______________________________________
F19 with F20-Kernel
*why?* there is no ipv6 configuration, BOOTPROTO=static is pretty clear IPV6INIT=no states clear *no ipv6 for me*
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.196.18 netmask 255.255.255.0 broadcast 192.168.196.255 inet6 fe80::20c:29ff:fe30:82b9 prefixlen 64 scopeid 0x20<link> ether 00:0c:29:30:82:b9 txqueuelen 1000 (Ethernet) RX packets 1437 bytes 117565 (114.8 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 1168 bytes 136471 (133.2 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
[root@rawhide ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0 DEVICE=eth0 HWADDR=00:0c:29:30:82:b9 ONBOOT=yes BOOTPROTO=static TYPE=Ethernet MODE=Managed IPADDR=192.168.196.18 NM_CONTROLLED=no IPV6INIT=no NETMASK=255.255.255.0 GATEWAY=192.168.196.2 USERCTL=no MTU=1500
Am 12.07.2013 18:09, schrieb J.Witvliet@mindef.nl:
If you got scared, why not keep the entire network down? If you want it, sure you can enable it ;-)
Enjoy your weekend.
-----Original Message----- From: users-bounces@lists.fedoraproject.org [mailto:users-bounces@lists.fedoraproject.org] On Behalf Of Fernando Lozano Sent: Friday, July 12, 2013 5:50 PM To: users@lists.fedoraproject.org Subject: Proposal: Fedora should install with NETWORK [was IPv6] disabled by default [was: Re: Disabling ipv6]
Hi Chris,
[As I changed the subject, let me clear: NETWORK [was: IPv6] still compiled in the kernel. Just the network interfaces configs that should come with NETWORK [was:IPv6] disabled by default, if the user wants it should be easy to enable]
On Sat, Jul 13, 2013 at 2:36 AM, Reindl Harald h.reindl@thelounge.net wrote:
this is childish
there is a difference between well aware ipv4 and all sorts of firewalls and proctections configured or startup in a network with ipv6 enabled without knowing it or not configured at all
coming up with a "link-local" address inside a network which is *pure ipv4* on a server means *any* random device which does the same may bypass all your firewall rule ssince iptables and ip6tables are two different services
so grow up and run an ipv6 firewall. or go back to a much older distro.
F19 with F20-Kernel
*why?* there is no ipv6 configuration, BOOTPROTO=static is pretty clear IPV6INIT=no states clear *no ipv6 for me*
I think you're barking up the wrong tree, take your arguement to kernel.org IPv6 Init is done in the kernel before initscripts even runs.
The question, should IPv6, be disabled by default, is asked of people of the user list.
At the moment, I am on the fence.
Is there a compromise where, during the Fedora install, when the person is asked for some network information and asked for time zone and root password, can the question be posed asking the initial state of IPv6?
Can a "help" entry be created that will explain why one will want IPv6 enabled and why one will not want IPv6 enabled?
If I have to jump off the fence, my answer would be, I believe the default should be enabled.
I have a router protecting my home network, where I can turn on/turn off IPv6.
As I indicated in another post, I believe my router is starting to support IPv6, but am not sure how well my router supports IPv6 yet. My router supports IPv6 traffic flow.
It is unclear how well my router's firewall works for IPv6. My router, for IPv4, does firewall and NAT (or as one person posted, and I liked his comment--NAT is firewall plus mangling). My router's default setting for IPv6 is disabled.
When the router vendor is willing to provide a firmware upgrade with IPv6 enabled, that will be a signal the router vendor has more confidence in his router implementation, including his firewall implementation, for IPv6.
When the ISP no longer uses 6to4 tunnel, that will be a signal the ISP is moving to provide full support for IPv6.
As an interesting side note, I went to http://ipv6-test.com/speedtest/ to compare the throughput for IPv4 and IPv6. It matters greatly which server I select. When I selected the Netherlands - Zeeland server, The IPv4 and IPv6 performance were close enough to being the same for me to say there was no performance loss going from IPv4 to IPv6.
When I tried another server, IPv6 was faster. When I tried still another server, IPv4 was faster. As another person commented in the other post, the path through which the packets travel matters.
The speed test results pleased me. The speed test results told me my ISP is trying to give me the downstream/upstream performance I am paying for be it IPv4 or IPv6.
On 07/12/2013 09:36 AM, Reindl Harald wrote:
coming up with a "link-local" address inside a network which is*pure ipv4* on a server means *any* random device which does the same may bypass all your firewall rule ssince iptables and ip6tables are two different services
It might be a good idea, then, to configure ip6tables to deny everything and enable it just to be sure.
It might be a good idea, then, to configure ip6tables to deny everything
and enable it just to be sure.
And this is one of the reasons that firewalld has come about... The same rule (unless it specifies a family or has addressees in the rule of that family) gets applied to both protocols.
It's time to stop ignoring it and treating ipv6 with the same level of care you do ipv4... If you really don't care about it then it's trivial to just have a drop all rule in ip6tables until you do care...
Incidentally there are other reasons you may need ipv6 loaded on an ipv4 network that can cause headaches otherwise such as the bonding module that has a dependency on ipv6 being loaded these days...
Am 14.07.2013 00:33, schrieb David Beveridge:
On Sat, Jul 13, 2013 at 2:36 AM, Reindl Harald h.reindl@thelounge.net wrote:
coming up with a "link-local" address inside a network which is *pure ipv4* on a server means *any* random device which does the same may bypass all your firewall rule since iptables and ip6tables are two different services
so grow up and run an ipv6 firewall. or go back to a much older distro
keep your polemic for you!
it is *the wrong* way to need setup firewalls for unused things - they have to be *disabled* entirely
period
F19 with F20-Kernel
*why?* there is no ipv6 configuration, BOOTPROTO=static is pretty clear IPV6INIT=no states clear *no ipv6 for me*
I think you're barking up the wrong tree, take your arguement to kernel.org IPv6 Init is done in the kernel before initscripts even runs
oh the kernel knows before the initscripts which interfaces are brougth up by them - interesting and funny theory!
Am 14.07.2013 01:43, schrieb Joe Zeff:
On 07/12/2013 09:36 AM, Reindl Harald wrote:
coming up with a "link-local" address inside a network which is *pure ipv4* on a server means *any* random device which does the same may bypass all your firewall rule ssince iptables and ip6tables are two different services
It might be a good idea, then, to configure ip6tables to deny everything and enable it just to be sure
and *that* is what is plain wrong
if you do not need smb/nfs/afp you simply do not start samba, nfsd and netatalk and not block the started services in the firewall
hence on a sane and specific amchine you should not need to enable any firewall at all if you can disable any type of network specific service except them which would be open anyway because the machines role as a public webserver as example
these are principles for network-administration and this thread was *not* intented to discuss about disable ipv6 completly nor the other direction - it had a very simple question until the first reply came
and that is why on a *static*, only ipv4 configured interface should not be a link-local address
since i have enough of this threads subject and content multiple changed by evangelists i restored it now - and i am the one who violates the etiquette? ridiculous if someone looks at this thread in tree-view
Am 14.07.2013 08:53, schrieb James Hogarth:
It might be a good idea, then, to configure ip6tables to deny everything and enable it just to be sure.
And this is one of the reasons that firewalld has come about... The same rule (unless it specifies a family or has addressees in the rule of that family) gets applied to both protocols.
so show me how do firewalld implement the rule sbelow which are my daily job (the second block especially for NAT/Routing) remember that there is an IT world outside the ordianry user and shiny GUIs
# Input-Controls $IPTABLES -A INPUT ! -i lo -f -j DROP $IPTABLES -A INPUT ! -i lo -m conntrack --ctstate INVALID -j DROP $IPTABLES -A INPUT ! -i lo -p tcp -m conntrack --ctstate NEW --dport 0 -j DROP $IPTABLES -A INPUT ! -i lo -p udp -m conntrack --ctstate NEW --dport 0 -j DROP $IPTABLES -A INPUT ! -i lo -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP $IPTABLES -A INPUT ! -i lo -p tcp --tcp-flags ALL FIN -j DROP $IPTABLES -A INPUT ! -i lo -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP $IPTABLES -A INPUT ! -i lo -p tcp --tcp-flags ALL ALL -j DROP $IPTABLES -A INPUT ! -i lo -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP $IPTABLES -A INPUT ! -i lo -p tcp --tcp-flags ALL NONE -j DROP $IPTABLES -A INPUT ! -i lo -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP $IPTABLES -A INPUT ! -i lo -p tcp --tcp-flags SYN,RST SYN,RST -j DROP $IPTABLES -A INPUT ! -i lo -p tcp --tcp-flags FIN,RST FIN,RST -j DROP $IPTABLES -A INPUT ! -i lo -p tcp --tcp-flags ACK,FIN FIN -j DROP $IPTABLES -A INPUT ! -i lo -p tcp --tcp-flags ACK,PSH PSH -j DROP $IPTABLES -A INPUT ! -i lo -p tcp --tcp-flags ACK,URG URG -j DROP $IPTABLES -A INPUT ! -i lo -p tcp ! --syn -m conntrack --ctstate NEW -j DROP $IPTABLES -A INPUT ! -i lo -s 127.0.0.0/8 -j DROP $IPTABLES -A INPUT ! -i lo ! -s $LAN_RANGE -p tcp -m ttl --ttl-lt 5 -j DROP $IPTABLES -A INPUT ! -i lo ! -s $LAN_RANGE -p udp -m ttl --ttl-lt 5 -j DROP PORTSCAN_TRIGGERS_1="19,24,52,79,109,142,442,464,548,586,631,992,994,3305" PORTSCAN_TRIGGERS_2="23,137,138,139,445,3389,5900" $IPTABLES -A INPUT ! -i lo ! -s $LAN_RANGE -p tcp -m recent --name portscan1 --rcheck --seconds 3 -j REJECT --reject-with tcp-reset $IPTABLES -A INPUT ! -i lo ! -s $LAN_RANGE -p tcp -m recent --name portscan1 --remove $IPTABLES -A INPUT ! -i lo ! -s $LAN_RANGE -p tcp -m multiport --destination-port $PORTSCAN_TRIGGERS_1 -m limit --limit 5/h -j LOG --log-level debug --log-prefix "Firewall Portscan: " $IPTABLES -A INPUT ! -i lo ! -s $LAN_RANGE -p tcp -m multiport --destination-port $PORTSCAN_TRIGGERS_1 -m tcp -m recent --name portscan1 --set -j REJECT --reject-with tcp-reset $IPTABLES -A INPUT ! -i lo ! -s $LAN_RANGE -p tcp -m recent --name portscan2 --rcheck --seconds 3 -j REJECT --reject-with tcp-reset $IPTABLES -A INPUT ! -i lo ! -s $LAN_RANGE -p tcp -m recent --name portscan2 --remove $IPTABLES -A INPUT ! -i lo ! -s $LAN_RANGE -p tcp -m multiport --destination-port $PORTSCAN_TRIGGERS_2 -m tcp -m recent --name portscan2 --set -j REJECT --reject-with tcp-reset echo "DOS-PROTECTION: Nicht mehr als $RATE_CONTROL_MAX NEUE Verbindungen pro 2-Sekunden/Client-IP (Rate-Control)" $IPTABLES -I INPUT -p tcp -i eth0 ! -s $LAN_RANGE -m conntrack --ctstate NEW -m recent --set $IPTABLES -I INPUT -p tcp -i eth0 ! -s $LAN_RANGE -m conntrack --ctstate NEW -m recent --update --seconds 2 --hitcount $RATE_CONTROL_MAX -j DROP $IPTABLES -I INPUT -p tcp -i eth0 ! -s $LAN_RANGE -m conntrack --ctstate NEW -m recent --update --seconds 2 --hitcount $RATE_CONTROL_MAX -m limit --limit 100/h -j LOG --log-level debug --log-prefix "Firewall Rate-Control: " $IPTABLES -I INPUT -p udp -i eth0 ! -s $LAN_RANGE -m conntrack --ctstate NEW -m recent --name udpflood --set $IPTABLES -I INPUT -p udp -i eth0 ! -s $LAN_RANGE -m conntrack --ctstate NEW -m recent --name udpflood --update --seconds 2 --hitcount $RATE_CONTROL_MAX -j DROP $IPTABLES -I INPUT -p udp -i eth0 ! -s $LAN_RANGE -m conntrack --ctstate NEW -m recent --name udpflood --update --seconds 2 --hitcount $RATE_CONTROL_MAX -m limit --limit 100/h -j LOG --log-level debug --log-prefix "Firewall Rate-Control: " $IPTABLES -A INPUT -p tcp -i eth0 ! -s $LAN_RANGE -m multiport --destination-port 80,443 --syn -m connlimit --connlimit-above $CONNECTION_MAX -m limit --limit 100/h -j LOG --log-level debug --log-prefix "Firewall Slowloris: " $IPTABLES -A INPUT -p tcp -i eth0 ! -s $LAN_RANGE -m multiport --destination-port 80,443 --syn -m connlimit --connlimit-above $CONNECTION_MAX -j DROP
echo "NAT Routing / Forwarding" $IPTABLES -A FORWARD -i eth1 -m conntrack --ctstate INVALID -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp -m conntrack --ctstate NEW --dport 0 -j DROP $IPTABLES -A FORWARD -i eth1 -p udp -m conntrack --ctstate NEW --dport 0 -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp --tcp-flags ALL FIN -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp --tcp-flags ALL ALL -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp --tcp-flags ALL NONE -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp --tcp-flags SYN,RST SYN,RST -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp --tcp-flags FIN,RST FIN,RST -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp --tcp-flags ACK,FIN FIN -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp --tcp-flags ACK,PSH PSH -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp --tcp-flags ACK,URG URG -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp ! --syn -m conntrack --ctstate NEW -j DROP $IPTABLES -A FORWARD -i eth1 -s 127.0.0.0/8 -j DROP $IPTABLES -A FORWARD -i eth1 -p tcp -m ttl --ttl-lt 5 -j DROP $IPTABLES -A FORWARD -i eth1 -p udp -m ttl --ttl-lt 5 -j DROP $IPTABLES -A FORWARD -i eth1 -p all -s 10.0.0.253 -m conntrack --ctstate NEW -j DROP $IPTABLES -A INPUT -i eth1 -s $WAN_RHSOFT,0.0.0.0/8,10.0.0.0/8,127.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.0.0.0/24,192.0.2.0/24,192.88.99.0/24,192.168.0.0/16,198.18.0.0/15,198.51.100.0/24,203.0.113.0/24,224.0.0.0/4,240.0.0.0/4,255.255.255.255/32 -j DROP $IPTABLES -A FORWARD -i eth1 -s $WAN_RHSOFT,0.0.0.0/8,10.0.0.0/8,127.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.0.0.0/24,192.0.2.0/24,192.88.99.0/24,192.168.0.0/16,198.18.0.0/15,198.51.100.0/24,203.0.113.0/24,224.0.0.0/4,240.0.0.0/4,255.255.255.255/32 -j DROP $IPTABLES -A OUTPUT -o eth1 -s 0.0.0.0/8,10.0.0.0/8,127.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.0.0.0/24,192.0.2.0/24,192.88.99.0/24,192.168.0.0/16,198.18.0.0/15,198.51.100.0/24,203.0.113.0/24,224.0.0.0/4,240.0.0.0/4,255.255.255.255/32 -j DROP $IPTABLES -A FORWARD -i eth1 -o br0 -d $LAN_RHSOFT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -i br0 -o eth1 -s $LAN_RHSOFT -j ACCEPT $IPTABLES -A FORWARD -i eth1 -o br1 -d $LAN_GUEST -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -i br1 -o eth1 -s $LAN_GUEST -j ACCEPT $IPTABLES -A FORWARD -i tap0 -s $LOUNGE_GUEST -j DROP $IPTABLES -A FORWARD -i tap0 -s $OFFICE_VPN_IP -j ACCEPT $IPTABLES -A FORWARD -i tap0 -o br0 -s $LAN_LOUNGE -d $LAN_RHSOFT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -i br0 -o tap0 -s $LAN_RHSOFT -d $LAN_LOUNGE -j ACCEPT $IPTABLES -A FORWARD -i tap0 -o br0 -s $LAN_SOUTH -d $LAN_RHSOFT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -i br0 -o tap0 -s $LAN_RHSOFT -d $LAN_SOUTH -j ACCEPT $IPTABLES -A FORWARD -i tap0 -o br0 -s $LAN_STOCK -d $LAN_RHSOFT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -i br0 -o tap0 -s $LAN_RHSOFT -d $LAN_STOCK -j ACCEPT $IPTABLES -A FORWARD -i tap0 -o br0 -s $LAN_FLOW -d $LAN_RHSOFT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -i br0 -o tap0 -s $LAN_RHSOFT -d $LAN_FLOW -j ACCEPT $IPTABLES -A FORWARD -i br0 -o vmnet8 -s $LAN_RHSOFT -d $LAN_VMWARE -j ACCEPT $IPTABLES -A FORWARD -i vmnet8 -o br0 -s $LAN_VMWARE -d $LAN_RHSOFT -j ACCEPT $IPTABLES -A FORWARD -i tap0 -o vmnet8 -s $OFFICE_VPN_IP -d $LAN_VMWARE -j ACCEPT $IPTABLES -A FORWARD -i vmnet8 -o tap0 -s $LAN_VMWARE -d $OFFICE_VPN_IP -j ACCEPT $IPTABLES -A PREROUTING -t nat -i eth1 -s $LOUNGE_VOIP -p udp -m multiport --destination-port 5060 -j DNAT --to-destination $RHSOFT_VOIP $IPTABLES -A PREROUTING -t nat -i eth1 -s $LOUNGE_VOIP -p udp -m multiport --destination-port 50600 -j DNAT --to-destination $RHSOFT_HANDY $IPTABLES -A POSTROUTING -o eth1 -t nat -s $LAN_RHSOFT -j MASQUERADE $IPTABLES -A POSTROUTING -o eth1 -t nat -s $LAN_GUEST -j MASQUERADE $IPTABLES -A POSTROUTING -o tap0 -t nat -s $LAN_RHSOFT -j MASQUERADE $IPTABLES -A POSTROUTING -o vmnet8 -t nat -s $LAN_RHSOFT -j MASQUERADE $IPTABLES -A POSTROUTING -o vmnet8 -t nat -s $OFFICE_VPN_IP -j MASQUERADE $IPTABLES -A FORWARD -j DROP $IPTABLES -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
It's time to stop ignoring it and treating ipv6 with the same level of care you do ipv4
no it is time to take care if i have at least at home *or* at office the possibility of a public ipv6 address which is not the case
... If you really don't care about it then it's trivial to just have a drop all rule in ip6tables until you do care...
again my question was why "ipv6.disable=1" on F19 with a 3.10.fc20 kernel is ignored
*not* more *not* less
so in a regular wolrd this thread would have 3-5 posts - period
that i get punished because violate the etiquette but my threads are going completly off-topic twice with twice changing the subject is only ridiculous
Incidentally there are other reasons you may need ipv6 loaded on an ipv4 network that can cause headaches otherwise such as the bonding module that has a dependency on ipv6 being loaded these days...
tell this my office-machine running with "ipv6.disable=1"