Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #246553 > unrolled thread

force IPv6 dynamic address?

Back to article view | Back to linux.debian.user

Contents

  force IPv6 dynamic address? Jeremy Ardley <jeremy@ardley.org> - 2022-03-22 22:20 +0100
    Re: force IPv6 dynamic address? Georgi Naplatanov <gosho@oles.biz> - 2022-03-23 09:10 +0100
    Re: force IPv6 dynamic address? Andy Smith <andy@strugglers.net> - 2022-03-23 14:30 +0100
    Re: force IPv6 dynamic address? Tim Woodall <debianuser@woodall.me.uk> - 2022-03-23 18:20 +0100
      Re: force IPv6 dynamic address? Tim Woodall <debianuser@woodall.me.uk> - 2022-03-23 18:20 +0100
      Re: force IPv6 dynamic address? Jeremy Ardley <jeremy@ardley.org> - 2022-03-24 10:00 +0100
        Re: force IPv6 dynamic address? Tim Woodall <debianuser@woodall.me.uk> - 2022-03-24 11:00 +0100
          Re: force IPv6 dynamic address? Jeremy Ardley <jeremy@ardley.org> - 2022-03-24 11:20 +0100

#246553 — force IPv6 dynamic address?

[Multipart message — attachments visible in raw view] — view raw

I have a debian workstation with a static IPv6 address mapped in DNS as 
well as dynamic addresses which change with time.

The problem I have is that when my thunderbird mail client connects to 
gmail it always uses the static IPv6 address as originator and this 
shows up in the headers of the delivered mail.

How can I make my system and/or thunderbird use the constantly changing 
dynamic IPv6 address instead?

-- 
Jeremy

[toc] | [next] | [standalone]

#246559

On 3/22/22 23:11, Jeremy Ardley wrote:
> I have a debian workstation with a static IPv6 address mapped in DNS as
> well as dynamic addresses which change with time.
> 
> The problem I have is that when my thunderbird mail client connects to
> gmail it always uses the static IPv6 address as originator and this
> shows up in the headers of the delivered mail.
> 
> How can I make my system and/or thunderbird use the constantly changing
> dynamic IPv6 address instead?
> 


Hi Jeremy,

I don't know whether you use Network Manager or not, but on IPv6 tab
there is a field "Privacy" with the following options:

 - Default
 - Disabled
 - Enabled (prefer public address)
 - Enabled (prefer temporary address).

Maybe you have to choose the last option.

Kind regards
Georgi

[toc] | [prev] | [next] | [standalone]

#246565

Hello,

On Wed, Mar 23, 2022 at 05:11:31AM +0800, Jeremy Ardley wrote:
> How can I make my system and/or thunderbird use the constantly changing
> dynamic IPv6 address instead?

If you add your static address with a preferred_lft of 0 then it
will be marked as "deprecated" which means it will never be chosen
as a source address unless forced to be. It will still be fully
usable in all other senses.

In /etc/network/interfaces:

iface eth0 inet6 static
    address 2001:db8:1:2::3
    netmask 64
    post-up ip addr change 2001:db8:1:2::3/64 dev $IFACE preferred_lft 0

Also, longest prefix will be selected as source address, so if you
add a /128 that will tend to be used.

The full rules for IPv6 source address selection are in RFC 6724…
which does say that temporary addresses should be preferred by
default, so I'm not sure why that's not happening for you.

It may depend on the value of the sysctl
/proc/sys/net/ipv6/conf/*/use_tempaddr. If that is 1 then temporary
addresses will be available but not forced to be used. >1 means they
are preferred, so it might be that.

Finally, you can also override it with a route entry:

# ip -6 route change default src 2001:db8:1:2::3

or for a specific net

# ip route add 2001:db8:99::/48 via <your normal default gw is> src 2001:db8:1:2::3

Cheers,
Andy

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

[toc] | [prev] | [next] | [standalone]

#246571

On Wed, 23 Mar 2022, Jeremy Ardley wrote:

> I have a debian workstation with a static IPv6 address mapped in DNS as well 
> as dynamic addresses which change with time.
>
> The problem I have is that when my thunderbird mail client connects to gmail 
> it always uses the static IPv6 address as originator and this shows up in the 
> headers of the delivered mail.
>
> How can I make my system and/or thunderbird use the constantly changing 
> dynamic IPv6 address instead?
>
>

I believe it's setting this to 2 that you want (I think there's a
setting to go in eni to do this too)

https://sysctl-explorer.net/net/ipv6/use_tempaddr/

Tim.

[toc] | [prev] | [next] | [standalone]

#246572

On Wed, 23 Mar 2022, Tim Woodall wrote:

> On Wed, 23 Mar 2022, Jeremy Ardley wrote:
>
>> I have a debian workstation with a static IPv6 address mapped in DNS as 
>> well as dynamic addresses which change with time.
>> 
>> The problem I have is that when my thunderbird mail client connects to 
>> gmail it always uses the static IPv6 address as originator and this shows 
>> up in the headers of the delivered mail.
>> 
>> How can I make my system and/or thunderbird use the constantly changing 
>> dynamic IPv6 address instead?
>> 
>> 
>
> I believe it's setting this to 2 that you want (I think there's a
> setting to go in eni to do this too)
>
> https://sysctl-explorer.net/net/ipv6/use_tempaddr/
>
> Tim.
>
>
man interfaces

privext int
        Privacy extensions (RFC4941) (0=off, 1=assign, 2=prefer)

[toc] | [prev] | [next] | [standalone]

#246585

[Multipart message — attachments visible in raw view] — view raw

On 24/3/22 1:11 am, Tim Woodall wrote:
> On Wed, 23 Mar 2022, Jeremy Ardley wrote:
>
>> I have a debian workstation with a static IPv6 address mapped in DNS 
>> as well as dynamic addresses which change with time.
>>
>> The problem I have is that when my thunderbird mail client connects 
>> to gmail it always uses the static IPv6 address as originator and 
>> this shows up in the headers of the delivered mail.
>>
>> How can I make my system and/or thunderbird use the constantly 
>> changing dynamic IPv6 address instead?
>>
>>
>
> I believe it's setting this to 2 that you want (I think there's a
> setting to go in eni to do this too)
>
> https://sysctl-explorer.net/net/ipv6/use_tempaddr/
>
> Tim.
>
My concern is that if I go to 1 or 2 then logging for non email activity 
may suffer.

In the meantime for my non gmail accounts I've modified my mail server thus

cat smtp_header_checks
/^Received:.*with ESMTPSA/  REPLACE Received: <REDACTED>
/^X-Originating-IP:/        IGNORE
/^X-Mailer:/                IGNORE
/^Mime-Version:/            IGNORE
/^User-Agent:/            IGNORE

Which also helps avoid the embarrassment of admitting I use Thunderbird :-)

-- 
Jeremy

[toc] | [prev] | [next] | [standalone]

#246586

On Thu, 24 Mar 2022, Jeremy Ardley wrote:

>
> On 24/3/22 1:11 am, Tim Woodall wrote:
>> I believe it's setting this to 2 that you want (I think there's a
>> setting to go in eni to do this too)
>> 
>> https://sysctl-explorer.net/net/ipv6/use_tempaddr/
>> 
>> 
> My concern is that if I go to 1 or 2 then logging for non email activity may 
> suffer.

I don't know how real network engineers would solve this, but at home I
tag all traffic based on MAC at my firewall so I can easily identify the
device in the iptables log regardless of the ip.

For traffic that is sent via an intercepting proxy I also rewrite the
ipv6 source address so that the (internal) ip is unique at the proxy.

Unknown MACs aren't allowed out.

But I'm as paranoid about unknown outbound connections as I am about
inbound ones - and, unfortunately, outbound is much harder to secure,
especially if you don't trust google!

[toc] | [prev] | [next] | [standalone]

#246587

[Multipart message — attachments visible in raw view] — view raw

On 24/3/22 5:53 pm, Tim Woodall wrote:
>
>
> But I'm as paranoid about unknown outbound connections as I am about
> inbound ones - and, unfortunately, outbound is much harder to secure,
> especially if you don't trust google!
>

Perhaps a specialised proxy for gmail etc connections that can strip out 
identifying information or substitute anonymised information?

gproxyd anyone

-- 
Jeremy

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web