Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

[Mikael Abrahamsson <[e-mail]>]

On Tue, 12 Nov 2013, Fred Baker (fred) wrote:

> My second premise is that any communication attempt directed to a 
> network, or to a application in a network, that doesn't have a 
> application in the network that willingly communicates with it is an 
> attack.

If it doesn't want to communicate, then it gives connection refused.

For me, a firewall is a way to have a policy that disallows connections to 
"dumb" services "inside" that can't protect itself. Basically, the 
firewall means that instead of making the home part of the Internet, it 
tries to limit its participation.

The classic unix model is that services below 1024 are privileged ports, 
and there lives most of the "sensitive" services. Userspace processes live 
in 1024 and above.

I believe I voiced opinion that I was fine with disallowing unsolicited 
connections from the outside to inside ports below 1024. This would mean 
most home services would not be accessible from the outside, but at least 
most of the peer-to-peer communication applications would work without 
restrictions since these live in the high ports.

The draft being discussed, balanced-security tries to identify weak 
services. I am fine with this approach as well, since it means the user 
doesn't have to do administration of for instance ssh services, but still 
blocks communication for the more common weak services. Having all 
incoming connections blocked would be a mistake, in my opinion.

I therefore support the WGLC of the above draft.

-- 
Mikael Abrahamsson    email: [e-mail]