[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: But are we talking IPv6 only? That's how I read the draft. (Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03)
On Thu, 28 Aug 2008 07:12:00 +0930, Mark Smith
<ipng@69706e6720323030352d30312d31340a.nosense.org> wrote:
> In that case, I'd still strongly suggest limiting the IPv6 in IPv6
> tunnel support to authenticated protocols only. Bypassing the CPE
> security using a linux box (or anything else that supports end-user
> manually configured tunnels, on which the user has admin priviledges)
> will be as simple as something like this (syntax probably not right ,
> but that's because I've got a few minutes before I need to get ready for
> work):
This is silly. If the user wants to bypass the CPE, (s)he can do it anyway.
The point of a CPE is to provide security that the user _wants_ to have,
not force security upon the user.
We are talking about simple CPEs - not corporate firewalls!
Blocking automatic tunneling (6to4 and/or Teredo) might make sense, but
blocking manually configured tunnel does not - regardless of
authentication.
--
Rémi Denis-Courmont