netdev - Re: bad interaction between privacy extensions, prefix lifetimes and protocols that maintain long-term connections.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87ziiy0ye6.fsf@miraculix.mork.no>
Date:   Wed, 11 Jan 2017 09:54:57 +0100
From:   Bjørn Mork <bjorn@...k.no>
To:     peter green <plugwash@...link.net>
Cc:     debian-ipv6@...ts.debian.org, netdev@...r.kernel.org
Subject: Re: bad interaction between privacy extensions, prefix lifetimes and protocols that maintain long-term connections.

peter green <plugwash@...link.net> writes:

> Disabling privacy extensions solved the issue but obviously reveals
> the MAC address of my new machine to the world which is undesirable.

I have no solution to the problem with privacy extensions, but just
wanted to let you know there is a third alternative for IPv6
autoconfigured addresses: stable-privacy

This will give you addresses which are just as stable as the eui64
addresses, but derived from a configurable secret instead of the
mac. The kernel part is documented in under 'stable_secret' in
https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt

If you use NetworkManager, then this is very easy to set up: Just set
'addr-gen-mode' to 'stable-privacy'.  See the docs in nm-settings(5).

Or if you use ifupdown and prefer to control it yourself, you can
e.g. save the secret (in IPv6 address format) in some file and write it
to /proc/sys/net/ipv6/conf/default/stable_secret on boot.  This will set
a common secret for all interfaces.  Note that the generated interface
ids still will be different, since the prefix is used as part of the
input to the generator.

Bjørn