[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: I-D.ietf-v6ops-cpe-simple-security-10
On Thu, 22 Apr 2010 19:05:34 +0200
Mark Townsley <townsley@cisco.com> wrote:
> On 4/22/10 6:38 PM, Timothy Baldwin wrote:
> > Mark Smith wrote:
> >> Would it be possible to make these rules a bit more general, such that
> >> they'd automatically cover things like IPsec, HIP or any other current
> >> (e.g. ssh) or future protocols that are authenticated, without
> >> nominating the protocols specifically?
>
> Being able to adapt to future protocols implies that there be a
> mechanism to communicate this adaptation. simple-security doesn't have
> that.
I think that if there is a statement of baseline expected security
for protocols, then a CPE vendor could add it as a default allow.
e.g. If XYZ security protocol, invented in 2015, and operating over UDP
port ABC, has end-to-end integrity as one it's properties, then vendors
who make CPE that is compliant with this draft can add UDP port ABC to
the list of permitted end-to-end protocols in 2015/2016. I think it is
possible to do that without being tied to specifying particular
protocols, as long as the required security properties are specified.
Otherwise we're in the trap of revising this draft/RFC for every new
protocol that has end-to-end integrity.
Regards,
Mark.
>
> > There are many ssh servers with default or poorly chosen passwords, so
> > that might not be a good idea.
>
> So Bob's bad password means Alice has to figure out how to configure a
> pinhole for ssh because she wants her ssh to be reachable from the
> Internet. Hardly fair, particularly when we don't even know what the
> intrusion rate would be for a given service/protocol over IPv6.
>
> Modern IPS firewalls actually have provisions for sniffing and blocking
> login attempts from the outside using poor/default passwords. But this
> isn't foolproof, and requires digging deeply into packets.
>
> It would be really nice if applications would be easily configurable for
> what IPv6 address scope they could use. Then when you turn on SSH, you
> are simply asked whether it should be made available on the Internet or not.
>
> - Mark
>
>
>
> >
> >
> >
> >
>
>