Hacker News Reader

Comment by pilif | Hacker News Reader

I really think it's time for guides to be written that don't contain the advice to disable all IPv6 support. IPv6 is coming. It's 2015 and categorically disabling (or actually just breaking) IPv6 definitely isn't good advice any more.

Yes. The article did qualify that advice with "unless you're using it...", but people should be doing v6, so advice should include v6 too.

View on HN

This. At least, if you're not ready to accept incoming v6 connections (which really isn't hard to do), use connection tracking to let outbound v6 through and add the necessary icmpv6 accept rules.

ufw comes pre-installed on ubuntu and is dead simple to use, there's really no reason not to use it.

  # ufw allow 22/tcp
  # ufw enable

should be all you need to have connection tracking on both v6 and v4, have a tried and trusted icmpv6 accept list, and keep your v6 and v4 firewalls in sync.

I like to use a limit rule (ufw limit 22/tcp) for SSH, to discourage brute force attacks. If nothing else, it will help reduce the noise in the log files.

This isn't a replacement for basic precautions such as disabling root login and not allowing password authentication, of course.

I prefer to not limit SSH but use fail2ban instead to remove the noise.

That. I was relived when I saw he advising against disabling ICMP, just to read that at the next paragraph.

It's past time ops security realize their job is to make the system run securely, not to stop it so nobody gets in.

It's even 2016 now.

Reply on news.ycombinator.com