Subject: I-D ACTION:draft-ietf-v6ops-unman-scenarios-00.txt

From: [email-masked]
Date: Thu, 16 Jan 2003 08:07:08 -0500

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the IPv6 Operations Working Group of the IETF.

	Title		: Unmanaged Networks IPv6 Transition Scenarios
	Author(s)	: C. Huitema, R. Austein, R. van der Pol
	Filename	: draft-ietf-v6ops-unman-scenarios-00.txt
	Pages		: 16
	Date		: 2003-1-15
	
In order to evaluate the suitability of transition mechanisms, we
need to define the scenarios in which these mechanisms have to be
used. One specific scope is the 'unmanaged networks', which
typically correspond to home networks or small office networks.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-v6ops-unman-scenarios-00.txt

To remove yourself from the IETF Announcement list, send a message to 
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-v6ops-unman-scenarios-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-v6ops-unman-scenarios-00.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Alain Durand <[email-masked]>
Date: Thu, 16 Jan 2003 17:53:12 -0800

I have several comments on draft-ietf-v6ops-unman-scenarios-00.txt.
Some minor ones and a major one, let me start by the later:

Security.

In IPv4+NAT, incoming connections are blocked unless
someone configured port forwarding. It means that a highly insecure
host in the unmanaged network has some degree of protection from the 
outside.
Not perfect, but at least it raises the bar a little. For example, I 
can have
an unconfigured network printer that is fully open, or not worry
too much about an potential security hole in the file server.

If IPv6 is turned on, in any of the described scenario A-D, all the 
sudden
all port from all addresses become reachable from the outside.
This is actually the benefit of IPv6, but it comes with a  price:
My unsecure hosts become more vulnerable, as they are now directly 
exposed,
and in my example, anybody can print on my network printer.
Security through obscurity helps a little here, as the IPv6 address of 
my
printer will be hard to guess. However, in the peer-to-peer example
described in the draft, the IPv6 address of the host gets published
so your peers can reach you. But what if there are services running
on the same hosts that are, let's say, not as robust as they should?
Maybe the peer-to-peer application is 'safe' but the 'backdoor' in the
file server has not been properly fixed...

This problem has different repercussions depending on which scenario 
you're in:

In scenario A, tunneling IPv6 over UDP to bypass the NAT/Firewall
creates a security breach. I understand this is the unmanaged case,
but if those techniques are applied in the enterprise (managed or 
unmanaged),
this can have serious consequences.

In scenario B, C & D, the CPE MUST implement an IPv6 firewall,
and make this one easy to administer in this unmanaged scenario ;-)

	- Alain.

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 18 Jan 2003 16:13:47 +0100

Is there any reason why we can't recommend strongly that the router
for an unman network should incorporate a firewall with most ports closed
by default, and opened manually on demand, as with most personal
firewall products?

There are some user interface design issues for such a solution, but
personal firewalls are a proof of concept.

   Brian

-- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Brian E Carpenter 
Distinguished Engineer, Internet Standards & Technology, IBM 
On assignment at the IBM Zurich Laboratory, Switzerland

---

From: Pekka Savola <[email-masked]>
Date: Sat, 18 Jan 2003 18:19:25 +0200 (EET)

On Thu, 16 Jan 2003, Alain Durand wrote:
> In IPv4+NAT, incoming connections are blocked unless someone configured
> port forwarding. It means that a highly insecure host in the unmanaged
> network has some degree of protection from the outside. Not perfect, but
> at least it raises the bar a little. For example, I can have an
> unconfigured network printer that is fully open, or not worry too much
> about an potential security hole in the file server.
> 
> sudden all port from all addresses become reachable from the outside.
[...]

I haven't read the latest draft yet, but there is a distict solution for 
this.

That is, *intentionally* do not provide any IPv6-Internet <-> 
IPv4-Unmanaged translation.  The security benefits or lack thereof are the 
same.

Only provide IPv6<->IPv4 translation _internally_ (if really required).

Then, make a requirement that devices which implement IPv6 and enable it
by default [in unmanaged networks scope at least] must have some security
mechanisms in place, like "personal firewalls".

Of course, we could try to strenghten the protections at the IPv6 router,
but that's probably a fight we could never win, only lose.

The best would of course be educating the folks about security of lack 
thereof provided by NAT and global addressing.

(Joe M. Arketeer could of course push IPv6 site-local addresses to solve
this particular problem, needless to say what I think of that..)

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Keith Moore <[email-masked]>
Date: Sat, 18 Jan 2003 13:43:14 -0500

On Sat, 18 Jan 2003 16:13:47 +0100
Brian E Carpenter <[email-masked]> wrote:

> for an unman network should incorporate a firewall with most ports
> closed by default, and opened manually on demand, as with most
> personal firewall products?

this is similar to what I've been thinking.

-- 
I tried enlightenment but it kept crashing.