Re: I-D.ietf-v6ops-cpe-simple-security-10

[Mark Townsley <townsley@cisco.com>]

On 4/22/10 6:38 PM, Timothy Baldwin wrote:
> Mark Smith wrote:
>> Would it be possible to make these rules a bit more general, such that
>> they'd automatically cover things like IPsec, HIP or any other current
>> (e.g. ssh) or future protocols that are authenticated, without
>> nominating the protocols specifically?

Being able to adapt to future protocols implies that there be a
mechanism to communicate this adaptation. simple-security doesn't have
that.

> There are many ssh servers with default or poorly chosen passwords, so
> that might not be a good idea.

So Bob's bad password means Alice has to figure out how to configure a
pinhole for ssh because she wants her ssh to be reachable from the
Internet. Hardly fair, particularly when we don't even know what the
intrusion rate would be for a given service/protocol over IPv6.

Modern IPS firewalls actually have provisions for sniffing and blocking
login attempts from the outside using poor/default passwords. But this
isn't foolproof, and requires digging deeply into packets.

It would be really nice if applications would be easily configurable for
what IPv6 address scope they could use. Then when you turn on SSH, you
are simply asked whether it should be made available on the Internet or not.

- Mark



> 
> 
> 
>