3 ms·
I really think it's time for guides to be written that don't contain the advice to disable all IPv6 support. IPv6 is coming. It's 2015 and categorically disabli
by pilif 11y ago
I really think it's time for guides to be written that don't contain the advice to disable all IPv6 support. IPv6 is coming. It's 2015 and categorically disabling (or actually just breaking) IPv6 definitely isn't good advice any more.
Yes. The article did qualify that advice with "unless you're using it...", but people should be doing v6, so advice should include v6 too.
- marcosdumay 11y agoThat. I was relived when I saw he advising against disabling ICMP, just to read that at the next paragraph. It's past time ops security realize their job is to make the system run securely, not to stop it so nobody gets in.
- simon_vetter 11y agoThis. At least, if you're not ready to accept incoming v6 connections (which really isn't hard to do), use connection tracking to let outbound v6 through and add the necessary icmpv6 accept rules. ufw comes pre-installed on ubuntu and is dead simple to use, there's really no reason not to use it. # ufw allow 22/tcp # ufw enable should be all you need to have connection tracking on both v6 and v4, have a tried and trusted icmpv6 accept list, and keep your v6 and v4 firewalls in sync.
- mordechai9000 11y agoI like to use a limit rule (ufw limit 22/tcp) for SSH, to discourage brute force attacks. If nothing else, it will help reduce the noise in the log files. This isn't a replacement for basic precautions such as disabling root login and not allowing password authentication, of course.
- zwetan 11y agoI prefer to not limit SSH but use fail2ban instead to remove the noise.
- orheep 11y agoIt's even 2016 now.