3

I'm setting up a Linode server and the Getting Started security guide suggests disabling ssh access over either IPv4 or IPv6 so that I only have one of the two enabled.

I understand the general theory of reducing attack surface, but why would I pick one over the other? How do I know which one I need?

Listen on only one internet protocol. The SSH daemon listens for incoming connections over both IPv4 and IPv6 by default. Unless you need to SSH into your Linode using both protocols, disable whichever you do not need. This does not disable the protocol system-wide, it is only for the SSH daemon.

Moshe
  • 160
  • 1
  • 9

3 Answers3

6

There can be several reasons to disable one or the other. My home and office have stable IPv6 addresses but always changing IPv4 addresses. So firewalling IPv6 is much easier and safer and therefore I close IPv4.

When I need to do maintenance I either ssh from a known network or I open a VPN and get IPv6 addresses that are allowed through the firewall.

It all depends on your environment, but this is what works for me :)

Sander Steffann
  • 7,712
  • 19
  • 29
2

As you may know there are many automated bots out there trying to break into systems on the Internet. Some of these attempt to connect to every system on the Internet via ssh and try common passwords.

Everyone who has ever put a system on the network has seen their logs fill up with messages about break in attempts. But, they are all on IPv4! There are none on IPv6. Bots attempt to connect to every IPv4 address that exists, but this is impossible with IPv6 as there are too many of them.

I usually leave both protocols enabled, but when I do disable one, it is IPv4.

Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
1

There are much more efficient ways to secure your ssh server. What I consider the two most important steps to secure ssh are:

  • Set up key based authentication and disable password authentication.
  • Keep the software up to date.

With those two in place there is very little security to be gained by disabling IPv4 or IPv6.

There are arguments in favor of having ssh configured to listen on both IPv4 and IPv6, even if you usually don't use both of them.

If one of the protocols is inaccessible due to a misconfiguration either on your server or on one of the provider's routers it is useful to be able to log in using the other protocol. In such situations having both IPv4 and IPv6 enabled will make problems much easier to debug.

kasperd
  • 30,455
  • 17
  • 76
  • 124