seems to me that for the most part, its pretty much enabled on everything by default. even if you dont get all the benefits of a properly configured IPv6, its still all there.
question is, do you get ANY benefits from it?
I'm a big fan of shutting off anything you dont need. ISP isnt IPv6 yet anyway, so are there any benefits to having a dual network stack, to offset the "cost"of it (no matter how negligibly small that is)?
@RoryAlsop TBH not so much. For testing it would cause some problems as we're targeting IPv4 addreses and on internal networks with NAT it's kind of not needed yet. Have made use of it on tests (managed to break our of an isolated network one time with an IPv6 interface that wasn't protected the same way the IPv4 one was)
Of course. I also just did a base install of Acrobat 9. That son of a bitch has 23 updates, doesn't have an auto-updater, and none of which are cumulative.
I was having a look at nessus today for the first time in a long time. When creating a new policy, why is the default to have every single plugin enabled? Is that a hint, suggesting it's best to throw everything you've got at a machine when scanning it?
My primary objective is to run a PCI DSS compliance scan. Under the 'compliance' category there are a number of PCI DSS related plugins. I was planning to just select these and nothing else for the purpose of that particular task. Is that wise or should i just slected the whole damn lot based on what you just said?
I've been searching for a couple days, even contacting support, to find out if Nessus has a bundle that scans for PCI compliance. It selects all 44 categories and regardless of what kind of scan I create (under policies) this is the default selection. Because this is the HTML5 version there seems...
Ah ha! I did see that default policy. I wasnt sure if '11.2.2' was the current PCI version number or if it refered to a section within the PCI specification..
OK - i dont know what that section is but i will guess its the section that relates to the requirement to perform regular vulnarability scanning..? I can look that up tomorrow
One final thing baffled me a bit. I was looking on the Nessus website and under downloads is a PCI audit file that can be imported into Nessus. It was unclear whether this adds something that the product lacks out-of-the-box or if its merely an update? I looked at the policy file in a text editor and could find no reference to a plugin number or anything...
@AviD well not so far as I can see it, especially as for most sites if you were pure Ipv6 you'd need a 6-to-4 gateway to get to them anyway so it's not even as though you're getting a more direct connection by losing that NAT
tbh everything here (so far) just supports v6 automatically, and anyway I wouldnt shut down v4. Question is, is it worth leaving enabled (and shut it off where its in the way) or shut it off everywhere, since there is no benefit.
@AviD for Windows domains be v. careful before turning stuff off I turned off IPv6 once with a windows Small business server in the name of attack surface reduction and it broke the whole thing :)
@AviD not too sure, as I've not tried it (I just leave the defaults alone), I would say it shouldn't cause a problem, but then I'd have said the same thing about the server before I broke it :)
@scott - thats a great explanation. thank you. The audit file I read was for windows clients and it had a section pertaining to determining the state of specific windows services.
@AviD The problem with v6, at this point, is that it's enabled by default on every modern OS. There are very rarely network monitoring or security features enabled for v6.
@AviD And since the systems (usually) attempt v6 first it effectively bypasses firewalls, IDSes, flow capture tools, etc, etc.
@AviD So the best practice is to disable v6 in any environment where the network security tools aren't fully v6 implemented.
My favourite expectation of "fun" as/if the IPv6 things pushes ahead is the huge numbers of regexes in custom code that expect an IP address to always have a xxx.xxx.xxx.xxx format
all of which will likely break when exposed to IPv6 networks
@AviD true in an ideal world I would've but didn't end up having the time to work out how to fix what broke when I turned it off....
@AviD yeah TBH it's mind boggling the likely complexity and impact on systems. I think a lot of people things that 'cause the mainline OSs' all support IPv6 now it'll be ok but the custom code things will cause all sorts of bother...
@AviD heh could be realistic time-line wise... I've not seen that or the other new one yet, must watch it sometime..
@RoryMcCune I think in scope it could likely be worse than Y2K. Only thing saving us is there is no deadline... and it could be patched piecemeal, not all at once.
wholly crap, the more I think about it.... yeah, the more ridiculous I'm realizing it is.
@AviD well I reckon that things like this will cause the deployment to slow/stall. Realistically there's a lot of unused IPv4 space, there just needs to be an incentive for companies to free it up
I was looking at an arbitrary expiration date in a table the other day and it got me slightly worried about the 9999 bug...but i though to hell with it, its definately gonna be someone elses problem by then...
There's a slight catch in my request - it must be able to survive the explorer process being killed - I have tried assigning a shortcut key to a desktop shortcut, but if the explorer process dies, it doesn't work any longer
I use Remote Assistance to well...offer remote assistance to our users. Sometimes when trying to close an app that's crashed, Windows likes to kill the explorer process. Then, I'm well and truly stuck - just faced with some nice desktop wallpaper...
Looks like the SAK is specifically disabled in Remote Assistance for security purposes. Given the nature of Remote Assistance (as opposed to RDP) this makes sense.
@Fitzroy Not an approach - the approach. When using Remote Assistance, you are controlling the user's session at their request. You should not be installing software to create or override keyboard shortcuts solely for administrative purposes when the user might otherwise be expecting them to do (or not do) something else.
If this was an issue over RDP, where you're logging into your own session and AHK only runs for you, then I'd say that's the way to go.
@Fitzroy It's in response to a user request, regardless. You're on the user's session at their behest (whether by coercion or otherwise), not your own.
@Iszi - I do see where you're going, but, what's the difference between me visting the user in person and opening taskmgr, or doing it from the comfort of my desk?
I concur with @Iszi. It does seem like you're falling down the engineer rabbit hole, trying to do everything automatically, when there is a perfectly good biological machine sitting and waiting for you.
@Fitzroy Ethics play into it as well. Remote Assistance isn't the same as RDP because it isn't RDP. It's not meant to be used without the end-user being in front of the system, and therefore there are some limitations built-in to prevent the remote admin from taking certain actions on the end-user's behalf.
I do see where you are coming from - honestly. I'd probably be pissed off if a friend offered to help me out through remote assistance and started doing such things. But in this setup - I am the appointed sysadmin and am reponsible for thse systems. I always call the user in advance to let them know i'm about to connect and they have to approve my request by acknowleging a messagebox and then approve a second time if i want remote control.
So whilst i can see the reason for the safeguards, in this case it does feel frustrating.
So, we're still in the same scenario: User is on the phone while you've assumed remote control. Is it really so hard to ask them to push three little buttons?
The point remains that it's a ridiculously simple task for the end-user to do, while they should already be in live contact with you anyway. You'll likely spend more hours trying to figure out a way to bypass the user, then figure out how to roll out that bypass to your entire network, then support maintenance and updates of the bypass, then support the breakages that the bypass creates (and I guarantee there will be some, or users will make them)...
...than you could possibly save in place of simply saying "Please press CTRL+ALT+DEL, and click on 'Start Task Manager'." whenever it is needed.
In fact, we've probably spent more time discussing it already than you might have saved over the course of 50 such occurrences of this problem.
I 100% agree - those are all the thoughts in my mind, which is why i was looking for a simple native way of doing it. if thats not possible, im not really all that interested in 3rd party solutions - again as i said, theres an overhead to consider when installing 3rd party apps.
If the shortcut would only be accessible to you, that's one thing. But since it will affect all users, you must expect you'll break something for someone. And there's really no good reason to do that for this case.
@Iszi Beleive me, I'm not 'sold' on this idea. it really is just an idea I'm playing with. And when you work alone on these things - its good to have someone else to really thrash out an idea with. So i do fully appreciate all that you have said.
its nice to be able to converse with people that can see all sides of an argument.
so thank you.
I'm really trying to bend RA to the point of being VNC. But I like RA because its a built in Windows component and thus configuration is simple (all done through a GPO) and authentication is tied into windows. I will just have to accept its limitations on this occasion me thinks.
