Basically every local service is accessed via a web interface, and every interface wants a username and password. Assuming none of these services are exposed to the internet, how much effort do you put into security here?
Personally, I didn’t really think about it when I started. I make a half-assed effort at security where I don’t use “admin” or anything obvious as the username, and I use a decent-but-not-industrial password - but I started reusing the u/p as the number of services I’m running grew. I have my browsers remember the u/ps.
Should one go farther than this? And if so, what’s the threat model? Is there an easier way?
Just because each device has a globally routable IP address doesn’t mean they can be accessed from outside your LAN. You still have to add a firewall rule to open a port to the device.
I was referring to the latest CVE for ipv6 where an attacker just sends a flood of IPv6 packets which puts things like WindowsOS into a mode for remote code execution, even via webpage. Windows remedy right now is turnoff all ipv6 capability, as they don’t have a fix yet
Apparently crafted webpage could be a vector. Router has to block fragmented packages also. The issue is non savvy people get shipped a router with Ipv6 firewall turned off (as a shit default setting) and don’t know to check it. And as it is a worm type it can come in with otger binaries
Lol, right, right. It’s only run the internet for what, 40 years now?
Guess you missed the recent gaping hole in IP6 on Windows?
IP6 is only really useful in large (i.e. enterprise) environments . It offers no practical benefit to small networks at the moment.
And even enterprise will only switch as they build out new infrastructure. The cost to switch is very high, and the risk is far more concerning than any potential benefit.
How many people are running public facing windows servers in their homelab/self-hosted environment?
And just because “it’s worked so far” isn’t a great reason to ignore new technology.
IPv6 is useful for public facing services. You don’t need a single proxy that covers all your http/s services.
It’s also significantly better for P2P applications, as you no longer need to rely on NAT traversal bodges or insecure uPTP type protocols.
If you are unlucky enough to be on IPv4 CGNAT but have IPv6 available, then you are no longer sharing reputation with everyone else on the same public IPv4 address. Also, IPv6 means you can get public access instead of having to rely on some RPoVPN solution.
If the router/gateway/network (IE not local) firewall is blocking forwarding unknown IPv6, then it’s a compromised server connected to via IPv6 that has the ability to leverage the exploit (IE your windows client connecting to a compromised server that is actively exploiting this IPv6 CVE).
It’s not like having IPv6 enabled on a windows machine automatically makes it instantly exploitable by anyone out there.
Routers/firewalls will only forward IPv6 for established connections, so your windows machine has to connect out.
Unless you are specifically forwarding to a windows machine, at which point you are intending that windows machine to be a server.
Essentially the same as some exploit in some service you are exposing via NAT port forwarding.
Maybe a few more avenues of exploit.
Like I said. Why would a self-hoster or homelabber use windows for a public facing service?!
If your windows computer makes an outbound connection to a server that is actively exploiting this, then yes: you will suffer.
But having a windows computer that is chilling behind a network firewall that is only forwarding established ipv6 traffic (like 99.9999% of default routers/firewalls), then you are extremely extremely ultra unlucky to be hit by this (or, you are such a high value target that it’s likely government level exploits). Or, you are an idiot visiting dogdy websites or running dodgy software.
Once a device on a local network has been successfully exploited for the RCE to actually gain useful code execution, then yes: the rest of your network is likely compromised.
Classic security in layers. Isolatation/layering of risky devices (that’s why my homelab is on a different vlan than my home network).
And even if you don’t realise your windows desktop has been exploited (I really doubt that this is a clean exploit, you would probably notice a few BSOD before they figure out how to backdoor), it then has to actually exploit your servers.
Even if they turn your desktop into a botnet node, that will very quickly be cleaned out by windows defender.
And I doubt that any attacker will have time to actually turn this into a useful and widespread exploit, except in targeting high value targets (which none of us here are. Any nation state equivalent of the US DoD isn’t lurking on Lemmy).
It comes back to: why are you running windows as a server?
ETA:
The possibility that high value targets are exposing windows servers on IPv6 via public addresses is what makes this CVE so high.
Sensible people and sensible companies will be using Linux.
Sensible people and sensible companies will be very closely monitoring what’s going on with windows servers exposed by ipv6.
This isn’t an “ipv6 exploit”. This is a windows exploit. Of which there have been MANY!
It offers no practical benefit to small networks at the moment.
The internet is not a “small network”, and I assume your small network is connected to it. You need local IPv6 routing to have access to IPv6-only hosts which are becoming more and more because it’s reasonable in terms of price to get an IPv6 block unlike IPv4 blocks which are being auctioned for tens of thousands of dollars at this point (!!!).
Also restoring global addressing is a huge benefit. P2P communications in IPv4 has become an insane mess of workarounds due to lack of addresses and this becomes worse the more layers of NAT you stick behind each other to try to save your ass from the rising tide.
I’m really sick of hearing these idiotic excuses over and over, “it’s hard” this, “it’s unsafe” that, “it’s expensive”, “understanding the eldritch secrets of IPv6 has driven 5 of my colleagues into madness” skill issue. THERE ARE NO MORE IPV4 ADDRESSES. So unless your network is so fucked that you haven’t managed to fix it in 26 years, since IPv6 has been standardized, or it really is just an internal network with no outward facing services where it doesn’t matter when someone who just has IPv6 can’t access it because they wouldn’t be able to access it anyway, and you’re not some kind of ISP, you have no reason not to have support for it at this point and you absolutely never have a reason to tell people it’s not “useful” because that is straight up wrong in the general case even if it might be true for your situation.
The only windows machine on my home network is the backup Windows laptop that I only boot when I need to run something like Odin to flash a tablet or some niche Nintendo switch management software.
I was referring to the latest CVE for ipv6 where an attacker just sends a flood of IPv6 packets which puts things like WindowsOS into a mode for remote code execution, even via webpage. Windows remedy right now is turnoff all ipv6 capability, as they don’t have a fix yet
Ipv6 is fantastic, it has less overhead than v4 and removes the need for NAT or other translation. Support can be spotty in cheaper and older devices but there’s no reason not to learn and adopt it where possible.
You have to take extra steps to ensure that the benefits of NAT aren’t lost when you switch to ipv6. Everyone knowing exactly which device you’re using because a single ipv6 IP per-device is the default.
Ipv6 is nice, but also you need to know what you’re doing to get all the benefits without any of the downsides.
Most devices generate a random IPv6 address and change it frequently. Your browser fingerprint is much more useful for device tracking than your IP address anyways.
+1, your list of browser extensions, list of plugins and list of available fonts are also available to anyone trying to fingerprint you. This idea that NAT will somehow obscure you enough to be anonymous online is security voodoo.
Your firewall should take care of that, it’s pretty rare to be connected directly without one and by default any decent routing package will filter incoming traffic that’s not in the state tracking table. NAT isn’t designed for security, any security benefit it provides is a side effect rather than the intended purpose.
Edit: check out ipv6 privacy extensions too, there are solutions there that can reduce info disclosure if that’s a concern. You can accomplish many of the same benefits of NAT with v6 features without the downsides that NAT brings.
Not access, knowledge. Giving a specifically unique device identifier every time you visit a page is different from the website guessing if you visited recently based on your screen size and cookies.
You have to set up ipv6 to change regularly to avoid that.
I mean, the horror of having to tick a box to use rotating v6 addresses. These are all solved problems, they’re not a flaw worth ignoring the entire ipv6 protocol over. Most major operating systems have moved to stable privacy preserving addresses by default, that’s true, but it’s not all that difficult to turn on address randomization and rotation either. And, hell, if you’re that married to NAT as security just use NAT66 and call it a day, nothing about NAT is exclusive to ipv4.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
But if they do, they have every password for all your stuff. hopefutlly you have Ipv6 disabled
Just because each device has a globally routable IP address doesn’t mean they can be accessed from outside your LAN. You still have to add a firewall rule to open a port to the device.
I was referring to the latest CVE for ipv6 where an attacker just sends a flood of IPv6 packets which puts things like WindowsOS into a mode for remote code execution, even via webpage. Windows remedy right now is turnoff all ipv6 capability, as they don’t have a fix yet
That’s a Windows problem, not an IPv6 problem.
Of course, but for a person with all machines on network having same user name and password it could become a larger problem
do self hosters use Windows? i would have thought most people were running Linux
I have seen both. Typically you expect somebody self hosting to be about privacy and freedom, and thus choosing Linux, but there are WinFans too
That still wouldn’t get past your firewall
Apparently crafted webpage could be a vector. Router has to block fragmented packages also. The issue is non savvy people get shipped a router with Ipv6 firewall turned off (as a shit default setting) and don’t know to check it. And as it is a worm type it can come in with otger binaries
IPv6 should not be disabled under any circumstances.
In fact, many devices in my house have IPv4 disabled. Disabling IPv4 on my public-facing SSH reduced the attack traffic to zero.
IPv4 is shit.
Lol, right, right. It’s only run the internet for what, 40 years now?
Guess you missed the recent gaping hole in IP6 on Windows?
IP6 is only really useful in large (i.e. enterprise) environments . It offers no practical benefit to small networks at the moment.
And even enterprise will only switch as they build out new infrastructure. The cost to switch is very high, and the risk is far more concerning than any potential benefit.
How many people are running public facing windows servers in their homelab/self-hosted environment?
And just because “it’s worked so far” isn’t a great reason to ignore new technology.
IPv6 is useful for public facing services. You don’t need a single proxy that covers all your http/s services.
It’s also significantly better for P2P applications, as you no longer need to rely on NAT traversal bodges or insecure uPTP type protocols.
If you are unlucky enough to be on IPv4 CGNAT but have IPv6 available, then you are no longer sharing reputation with everyone else on the same public IPv4 address. Also, IPv6 means you can get public access instead of having to rely on some RPoVPN solution.
Any device on the network would make it vulnerable, what does a server have to do with anything?
If the router/gateway/network (IE not local) firewall is blocking forwarding unknown IPv6, then it’s a compromised server connected to via IPv6 that has the ability to leverage the exploit (IE your windows client connecting to a compromised server that is actively exploiting this IPv6 CVE).
It’s not like having IPv6 enabled on a windows machine automatically makes it instantly exploitable by anyone out there.
Routers/firewalls will only forward IPv6 for established connections, so your windows machine has to connect out.
Unless you are specifically forwarding to a windows machine, at which point you are intending that windows machine to be a server.
Essentially the same as some exploit in some service you are exposing via NAT port forwarding.
Maybe a few more avenues of exploit.
Like I said. Why would a self-hoster or homelabber use windows for a public facing service?!
… all it can take is going to a website from a windows device… maybe less, it was literally discovered a couple days ago…
Yes it actually kinda does, that’s why this exploit is considered the highest priority and critical.
But sure… downplay it, because we only think servers are at risk…
Yeesh buddy.
If your windows computer makes an outbound connection to a server that is actively exploiting this, then yes: you will suffer.
But having a windows computer that is chilling behind a network firewall that is only forwarding established ipv6 traffic (like 99.9999% of default routers/firewalls), then you are extremely extremely ultra unlucky to be hit by this (or, you are such a high value target that it’s likely government level exploits). Or, you are an idiot visiting dogdy websites or running dodgy software.
Once a device on a local network has been successfully exploited for the RCE to actually gain useful code execution, then yes: the rest of your network is likely compromised.
Classic security in layers. Isolatation/layering of risky devices (that’s why my homelab is on a different vlan than my home network).
And even if you don’t realise your windows desktop has been exploited (I really doubt that this is a clean exploit, you would probably notice a few BSOD before they figure out how to backdoor), it then has to actually exploit your servers.
Even if they turn your desktop into a botnet node, that will very quickly be cleaned out by windows defender.
And I doubt that any attacker will have time to actually turn this into a useful and widespread exploit, except in targeting high value targets (which none of us here are. Any nation state equivalent of the US DoD isn’t lurking on Lemmy).
It comes back to: why are you running windows as a server?
ETA:
The possibility that high value targets are exposing windows servers on IPv6 via public addresses is what makes this CVE so high.
Sensible people and sensible companies will be using Linux.
Sensible people and sensible companies will be very closely monitoring what’s going on with windows servers exposed by ipv6.
This isn’t an “ipv6 exploit”. This is a windows exploit. Of which there have been MANY!
The internet is not a “small network”, and I assume your small network is connected to it. You need local IPv6 routing to have access to IPv6-only hosts which are becoming more and more because it’s reasonable in terms of price to get an IPv6 block unlike IPv4 blocks which are being auctioned for tens of thousands of dollars at this point (!!!).
Also restoring global addressing is a huge benefit. P2P communications in IPv4 has become an insane mess of workarounds due to lack of addresses and this becomes worse the more layers of NAT you stick behind each other to try to save your ass from the rising tide.
I’m really sick of hearing these idiotic excuses over and over, “it’s hard” this, “it’s unsafe” that, “it’s expensive”, “understanding the eldritch secrets of IPv6 has driven 5 of my colleagues into madness” skill issue. THERE ARE NO MORE IPV4 ADDRESSES. So unless your network is so fucked that you haven’t managed to fix it in 26 years, since IPv6 has been standardized, or it really is just an internal network with no outward facing services where it doesn’t matter when someone who just has IPv6 can’t access it because they wouldn’t be able to access it anyway, and you’re not some kind of ISP, you have no reason not to have support for it at this point and you absolutely never have a reason to tell people it’s not “useful” because that is straight up wrong in the general case even if it might be true for your situation.
Why not disable ipv6 for local lan?
I disable It on everything for next decade until it’s mainstream.
.
IPv6 was just found to have a critical exploit, and the solution is to disable it.
I’m pretty sure that vulnerability only affected windows machines. Surely you’re not running a homelab with windows server?
https://en.wikipedia.org/wiki/Windows_Home_Server
:D
Wouldn’t any windows device in your network be vulnerable? And from there everything else.
The only windows machine on my home network is the backup Windows laptop that I only boot when I need to run something like Odin to flash a tablet or some niche Nintendo switch management software.
And now your entire system/network is vulnerable because of it. Great idea!
Yes, the machine that stays off 363 days of the year is such a security risk to my home network 🙄
Great, so let’s suppress a warning because YOU are fine…
Maybe other people don’t realize the issue, but of course you aren’t thinking about anyone but yourself now aren’t you?
I was referring to the latest CVE for ipv6 where an attacker just sends a flood of IPv6 packets which puts things like WindowsOS into a mode for remote code execution, even via webpage. Windows remedy right now is turnoff all ipv6 capability, as they don’t have a fix yet
I know about that one. The 800MB “fix” for it has been crashing machines quite hard.
I don’t have that problem because I don’t run Windows.
Windows is shit.
Is ipv6 that bad.
I keep hearing there is no real benefit and risk to it?
Ipv6 is fantastic, it has less overhead than v4 and removes the need for NAT or other translation. Support can be spotty in cheaper and older devices but there’s no reason not to learn and adopt it where possible.
You have to take extra steps to ensure that the benefits of NAT aren’t lost when you switch to ipv6. Everyone knowing exactly which device you’re using because a single ipv6 IP per-device is the default.
Ipv6 is nice, but also you need to know what you’re doing to get all the benefits without any of the downsides.
Most devices generate a random IPv6 address and change it frequently. Your browser fingerprint is much more useful for device tracking than your IP address anyways.
+1, your list of browser extensions, list of plugins and list of available fonts are also available to anyone trying to fingerprint you. This idea that NAT will somehow obscure you enough to be anonymous online is security voodoo.
Your firewall should take care of that, it’s pretty rare to be connected directly without one and by default any decent routing package will filter incoming traffic that’s not in the state tracking table. NAT isn’t designed for security, any security benefit it provides is a side effect rather than the intended purpose.
Edit: check out ipv6 privacy extensions too, there are solutions there that can reduce info disclosure if that’s a concern. You can accomplish many of the same benefits of NAT with v6 features without the downsides that NAT brings.
Not access, knowledge. Giving a specifically unique device identifier every time you visit a page is different from the website guessing if you visited recently based on your screen size and cookies.
You have to set up ipv6 to change regularly to avoid that.
I mean, the horror of having to tick a box to use rotating v6 addresses. These are all solved problems, they’re not a flaw worth ignoring the entire ipv6 protocol over. Most major operating systems have moved to stable privacy preserving addresses by default, that’s true, but it’s not all that difficult to turn on address randomization and rotation either. And, hell, if you’re that married to NAT as security just use NAT66 and call it a day, nothing about NAT is exclusive to ipv4.
There was an article that many Routers were shipped with Ipv6 firewall off, and less savvy users would never know to check