17.3. IPv6 security auditing

17.3.1. Legal issues

ATTENTION: always take care that you only scan your own systems or after receiving a written order, otherwise legal issues are able to come up to you. CHECK destination IPv6 addresses TWICE before starting a scan.

17.3.2. Security auditing using IPv6-enabled netcat

With the IPv6-enabled netcat (see IPv6+Linux-status-apps/security-auditing for more) you can run a portscan by wrapping a script around which run through a port range, grab banners and so on. Usage example:

# nc6 ::1 daytime
13 JUL 2002 11:22:22 CEST
   

17.3.3. Security auditing using IPv6-enabled nmap

NMap, one of the best portscaner around the world, supports IPv6 since version 3.10ALPHA1. Usage example:

# nmap -6 -sT ::1
Starting nmap V. 3.10ALPHA3 ( www.insecure.org/nmap/ ) 
Interesting ports on localhost6 (::1): 
(The 1600 ports scanned but not shown below are in state: closed) 
Port       State       Service 
22/tcp     open        ssh 
53/tcp     open        domain 
515/tcp    open        printer 
2401/tcp   open        cvspserver
Nmap run completed -- 1 IP address (1 host up) scanned in 0.525 seconds
   

17.3.4. Security auditing using IPv6-enabled strobe

Strobe is a (compared to NMap) more a low budget portscanner, but there is an IPv6-enabling patch available (see IPv6+Linux-status-apps/security-auditing for more). Usage example:

# ./strobe ::1 strobe 1.05 (c) 1995-1999 Julian Assange <proff@iq.org>.
::1 2401 unassigned unknown
::1 22 ssh Secure Shell - RSA encrypted rsh 
::1 515 printer spooler (lpd)
::1 6010 unassigned unknown 
::1 53 domain Domain Name Server
   

Note: strobe isn't really developed further on, the shown version number isn't the right one.

17.3.5. Audit results

If the result of an audit mismatch your IPv6 security policy, use IPv6 firewalling to close the holes, e.g. using netfilter6 (see Firewalling/Netfilter6 for more).

Info: More detailed information concerning IPv6 Security can be found here:

• Firewalling Considerations for IPv6 / draft-savola-v6ops-firewalling-??.txt

• IPv6 Neighbour Discovery trust models and threats / draft-ietf-send-psreq-??.txt

• Security Considerations for 6to4 / draft-savola-v6ops-6to4-security-??.txt

• Access Control Prefix Router Advertisement Option for IPv6 / draft-bellovin-ipv6-accessprefix-??.txt

• Requirements for Plug and Play IPsec for IPv6 applications /draft-kobayakawa-ipsec-ipv6-pnpipsec-reqts-??.txt

• Security of IPv6 Routing Header and Home Address Options / draft-savola-ipv6-rh-ha-security-??.txt