Hi Eric,
Sorry, about the bounce, first time I reported a bug on that
box.
> Approx doesn't support IPv6 yet, but I've just about finished adding
it.
> Since I don't really use IPv6 myself, I have a question for you about
> how to support it.
> Currently you can only tell approx either to listen to a specific
> interface, or to "any". Although it's possible to have multiple IPv4
> addresses per interface, it's uncommon, and nobody has requested the
> ability to listen on a particular one.
> Is it more common to have multiple addresses in IPv6, and will it be
> important to specify which one(s) to listen on?
I am also learning IPv6, so am not confident yet.
It is required/default to have multiple addresses in IPv6.
There is a local-link address (think 10.x.y.z for every network) that is
configured by default. Usually there is an IP assigned by your
router or DHCPv6 server, this is your routable address. Additionally
(or maybe instead of, as I haven't tried yet), you can configure static
IPv6 addresses.
Partial answer, all of the documentation I have seen has
multiple IPv6 addresses per interface.
I have not seen a concensus as to how to write IPv6 servers yet.
Listening on all IPv6 addresses would be acceptable to me, if I can
limit
access to certain IPs (say with tcpwrappers). Both postfix and ssh
appear
to allow binding to a specific IPv6 address, but they lead on the
security curve. On the other hand bind9 seems to only allow IPv6
listening to be enabled or disabled, not by port/IP (although it does
have internal acls).
The somewhat vague answer is to request that the clients
connecting
can be limited appropriately. I am using tcpwrappers for security on
other services in IPv6. Limiting to the local-link address would also
work in my configuration. IPv6 firewalls are not as developed/tested as
IPv4 firewalls, so I do not trust them to provide as much security for
now.
Warren
