IPV6 and security?

Steve Grubb sgrubb at redhat.com
Tue Mar 25 21:22:56 UTC 2014


On Tuesday, March 25, 2014 04:55:54 PM Frank Caviggia wrote:
> In general the White House mandate on IPv6 is gaining traction - the
> National Laboratories, Universities, and some DoD agencies (DTRA) are
> running with the mandate. I would recommend that IPv6 be left on as long as
> ip6tables/firewall is running. Perhaps a RHEL 7 STIG requirement?

The view taking in hardening systems is if you don't need something, turn it 
off so that you don't have inadvertent security problems. Paraphrasing the 
RHEL5 SNAC guide, it says if you need IPv6, here are the hardening steps. If 
you do not, then turn it off. That is the prudent thing to do in all cases.

Put another way, its not that IPv6 is insecure...its very well tested. Its 
that if you don't need it or use it and a security bulletin comes along for 
it, its easy to dismiss because you didn't intend to use it.


> > Are the security concerns around IPV6 about the maturity of the
> > protocol stack, or the reduced utility of NAT, or?

I'd put this back on the OP. Who said it _is_ insecure?

-Steve


More information about the scap-security-guide mailing list