Verify ip6tables Enabled if Using IPv6
An XCCDF Rule
Description
The ip6tables
service can be enabled with the following manifest:
--- apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig metadata: labels: machineconfiguration.openshift.io/role: master name: 75-master-ip6tables-enable spec: config: ignition: version: 3.1.0 systemd: units: - name: ip6tables.service enabled: true
This will enable the ip6tables
service in all the
nodes labeled with the "master" role.
Note that this needs to be done for each MachineConfigPool
For more information on how to configure nodes with the Machine Config Operator see the relevant documentation.
Rationale
The ip6tables
service provides the system's host-based firewalling
capability for IPv6 and ICMPv6.
- ID
- xccdf_org.ssgproject.content_rule_service_ip6tables_enabled
- Severity
- Medium
- References
- Updated