lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 11 Jan 2017 09:54:57 +0100 From: Bjørn Mork <bjorn@...k.no> To: peter green <plugwash@...link.net> Cc: debian-ipv6@...ts.debian.org, netdev@...r.kernel.org Subject: Re: bad interaction between privacy extensions, prefix lifetimes and protocols that maintain long-term connections. peter green <plugwash@...link.net> writes: > Disabling privacy extensions solved the issue but obviously reveals > the MAC address of my new machine to the world which is undesirable. I have no solution to the problem with privacy extensions, but just wanted to let you know there is a third alternative for IPv6 autoconfigured addresses: stable-privacy This will give you addresses which are just as stable as the eui64 addresses, but derived from a configurable secret instead of the mac. The kernel part is documented in under 'stable_secret' in https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt If you use NetworkManager, then this is very easy to set up: Just set 'addr-gen-mode' to 'stable-privacy'. See the docs in nm-settings(5). Or if you use ifupdown and prefer to control it yourself, you can e.g. save the secret (in IPv6 address format) in some file and write it to /proc/sys/net/ipv6/conf/default/stable_secret on boot. This will set a common secret for all interfaces. Note that the generated interface ids still will be different, since the prefix is used as part of the input to the generator. Bjørn
Powered by blists - more mailing lists