IETF Logo Mail Archive

Re: But are we talking IPv6 only? That's how I read the draft. (Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03)

Rémi Denis-Courmont <rdenis@simphalempin.com> Thu, 28 August 2008 07:57 UTC

Return-Path: <owner-v6ops@ops.ietf.org>
X-Original-To: ietfarch-v6ops-archive@core3.amsl.com
Delivered-To: ietfarch-v6ops-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA8A53A6A1D for <ietfarch-v6ops-archive@core3.amsl.com>; Thu, 28 Aug 2008 00:57:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.512
X-Spam-Level:
X-Spam-Status: No, score=-101.512 tagged_above=-999 required=5 tests=[AWL=0.636, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, SARE_SUB_ENC_UTF8=0.152, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fzAvOvYAYzPX for <ietfarch-v6ops-archive@core3.amsl.com>; Thu, 28 Aug 2008 00:57:48 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id EBA0A3A685F for <v6ops-archive@lists.ietf.org>; Thu, 28 Aug 2008 00:57:47 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from <owner-v6ops@ops.ietf.org>) id 1KYcF8-000DFj-B0 for v6ops-data@psg.com; Thu, 28 Aug 2008 07:48:34 +0000
Received: from [2001:41d0:1:a0d6::401:1983] (helo=yop.chewa.net) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from <rdenis@simphalempin.com>) id 1KYcF3-000DEM-A0 for v6ops@ops.ietf.org; Thu, 28 Aug 2008 07:48:32 +0000
Received: by yop.chewa.net (Postfix, from userid 33) id 64C1B814; Thu, 28 Aug 2008 09:48:25 +0200 (CEST)
To: Mark Smith <ipng@69706e6720323030352d30312d31340a.nosense.org>
Subject: Re: But are we talking IPv6 only? That's how I read the draft. (Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03)
MIME-Version: 1.0
Date: Thu, 28 Aug 2008 09:48:25 +0200
From: Rémi Denis-Courmont <rdenis@simphalempin.com>
Cc: james woodyatt <jhw@apple.com>, IPv6 Operations <v6ops@ops.ietf.org>
Organization: Remlab.net
In-Reply-To: <20080828071200.212c7910.ipng@69706e6720323030352d30312d31340a.nosense.org>
References: <20080824204553.08131c65.ipng@69706e6720323030352d30312d31340a.nosense.org> <48B1CCE8.1070305@gmail.com> <01af01c9065b$b4602440$c2f0200a@cisco.com> <48B23391.1090503@gmail.com> <01cd01c90672$a57c8790$c2f0200a@cisco.com> <48B31DA3.6080001@gmail.com> <07d201c906f7$50a85e30$c2f0200a@cisco.com> <48B32B43.5010103@gmail.com> <084c01c906fe$f9bf1840$c2f0200a@cisco.com> <48B33430.40704@gmail.com> <A31EB889-2BD9-4283-A408-AB6DCC1D568A@suspicious.org> <08be01c90712$d876cd40$c2f0200a@cisco.com> <20080827194713.23271bd1.ipng@69706e6720323030352d30312d31340a.nosense.org> <CD947C45-58F7-47F1-807F-A276490B1E39@apple.com> <20080828071200.212c7910.ipng@69706e6720323030352d30312d31340a.nosense.org>
Message-ID: <0a778520d314db21a197b978a43b8644@chewa.net>
X-Sender: rdenis@simphalempin.com
User-Agent: RoundCube Webmail/0.1
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Sender: owner-v6ops@ops.ietf.org
Precedence: bulk
List-ID: <v6ops.ops.ietf.org>

On Thu, 28 Aug 2008 07:12:00 +0930, Mark Smith

<ipng@69706e6720323030352d30312d31340a.nosense.org> wrote:

> In that case, I'd still strongly suggest limiting the IPv6 in IPv6

> tunnel support to authenticated protocols only. Bypassing the CPE

> security using a linux box (or anything else that supports end-user

> manually configured tunnels, on which the user has admin priviledges)

> will be as simple as something like this (syntax probably not right ,

> but that's because I've got a few minutes before I need to get ready for

> work):



This is silly. If the user wants to bypass the CPE, (s)he can do it anyway.

The point of a CPE is to provide security that the user _wants_ to have,

not force security upon the user.



We are talking about simple CPEs - not corporate firewalls!



Blocking automatic tunneling (6to4 and/or Teredo) might make sense, but

blocking manually configured tunnel does not - regardless of

authentication.



-- 

Rémi Denis-Courmont

v2.23.0 | Report a Bug | By Email