Subject: RE: use of site-locals as an indication of policy?

From: "Richard Draves" <[email-masked]>
Date: Fri, 15 Nov 2002 14:35:58 -0800

I think the answer is yes, it is reasonable to use site-locals as an
indication of policy. The kind of examples I have in mind are

1) A default configuration for some applications (eg database, file, and
print servers) might be to only accept connections from site-local
addresses. These applications would be running on hosts with both global
and site-local addresses.

2) A default configuration for some IP appliances (eg printers) might be
to only configure link-local and site-local addresses.

Rich

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Fri, 15 Nov 2002 17:50:01 -0500

> and site-local addresses.

would it be reasonable for applications to assume this rather than 
having a particular kind of site policy be assumed by default?

my view is that security policy should always be explicit, never assumed.

in general, the application writer has no idea what degree of trust 
is invested in "local" hosts.
 
> to only configure link-local and site-local addresses.

I can see doing this to allow initial configuration of hardware devices 
without keyboards and displays (though use of link-local would be even 
better). but again, I don't see it as reasonable for the device vendor 
to make assumptions about a customer's security policy.

Keith

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Sun, 17 Nov 2002 15:08:11 -0500

do you mean that it's appropriate policy for equipment/application 
manufacturers to ship products that will only work out of the box if 
site-locals are configured on the network?

I'd like to preserve the ability to run a network without configuring 
site-locals without too much impact.......

                Harald

---

From: "Tony Hain" <[email-masked]>
Date: Sun, 17 Nov 2002 16:08:36 -0500

> site-locals without too much impact.......

I think the point was that for some applications (like printers), it is
unreasonable to assume that everyone (or even anything close to a
majority) will want them globally accessible out of the box. At the same
time the majority do want them to work locally out of the box. Without
explicit configuration, how would the application distinguish global vs.
local accessibility if it only had a global prefix to work with? The
alternative is that before you can connect the shiny new printer you
bought, you have to wait for the network administrator to install the
appropriate filter at the border, or you have to wait for the DHCP
administrator to add you printer so that it will be allocated an address
that is in the range of an existing filter. 

There is nothing requiring that you run the network with SL. Just that
if you choose to do so, there will be some devices and applications that
will require less work. Personally if I were building an
auto-configuring device that is most often intended for local-use, I
would have it configure only the SL if one existed in the RA, but if
there was no SL, configure all global prefixes. This would allow you to
run without SL, but allow those that run with it to not worry about
those devices being reached without explicit effort to change the
default.

Tony

> > 1) A default configuration for some applications (eg 
> database, file, 
> > and print servers) might be to only accept connections from 
> site-local 
> > addresses. These applications would be running on hosts with both 
> > global and site-local addresses.
> >
> > 2) A default configuration for some IP appliances (eg 
> printers) might 
> > be to only configure link-local and site-local addresses.
> >
> > Rich
> >

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Sun, 17 Nov 2002 16:17:40 -0500

> those devices being reached without explicit effort to change the

since I normally print on my office printer through an SSH tunnel running 
through my VPN to Amsterdam (don't ask me to explain the security 
guidelines that led me to start doing this, please....), I certainly can 
see reasons why you would want to allow a printer to be globally 
accessible...... but I see your point.

                    Harald

---

From: Keith Moore <[email-masked]>
Date: Mon, 18 Nov 2002 10:19:03 -0500

to me it seems completely unreasonable for any device to make
any assuumptions about the trust level placed in "site-local"
addresses.  this should be a MUST NOT.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Tony Hain" <[email-masked]>
Date: Mon, 18 Nov 2002 13:30:29 -0500

> addresses.  this should be a MUST NOT.

Why do you keep insisting that lack of public accessability implies
anything about trust?

Tony

---

From: Keith Moore <[email-masked]>
Date: Mon, 18 Nov 2002 17:06:53 -0500

> Why do you keep insisting that lack of public accessability implies

you are the one making such assertions.