Ensure IPv6 is disabled through kernel boot parameter

An XCCDF Rule

Description

To disable IPv6 protocol support in the Linux kernel, add the argument ipv6.disable=1 to the default GRUB2 command line for the Linux operating system. To ensure that ipv6.disable=1 is added as a kernel command line argument to newly installed kernels, add ipv6.disable=1 to the default Grub2 command line for Linux operating systems. Modify the line within /etc/default/grub as shown below:

GRUB_CMDLINE_LINUX="... ipv6.disable=1 ..."

Run the following command to update command line for already installed kernels:

# grubby --update-kernel=ALL --args="ipv6.disable=1"

Rationale

Any unnecessary network stacks, including IPv6, should be disabled to reduce the vulnerability to exploitation.

ID: xccdf_org.ssgproject.content_rule_grub2_ipv6_disable_argument
Severity: Low
References: Req-1.3.1 Req-1.3.2

3.3.3

CCE-82886-3
Updated: about 1 year ago

[customizations.kernel]
append = "ipv6.disable=1"

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-82886-3
  - PCI-DSS-Req-1.3.1  - PCI-DSS-Req-1.3.2
  - grub2_ipv6_disable_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Check ipv6.disable argument exists
  command: grep '^\s*GRUB_CMDLINE_LINUX=.*ipv6.disable=' /etc/default/grub
  failed_when: false
  register: argcheck
  when: '"grub2-common" in ansible_facts.packages'
  tags:
  - CCE-82886-3
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - grub2_ipv6_disable_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Check ipv6.disable argument exists
  command: grep '^\s*GRUB_CMDLINE_LINUX=' /etc/default/grub
  failed_when: false
  register: linecheck
  when: '"grub2-common" in ansible_facts.packages'
  tags:
  - CCE-82886-3
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - grub2_ipv6_disable_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Add ipv6.disable argument
  ansible.builtin.lineinfile:
    line: GRUB_CMDLINE_LINUX="ipv6.disable=1 "
    state: present
    dest: /etc/default/grub
    create: true
    mode: '0644'
  when:
  - '"grub2-common" in ansible_facts.packages'
  - argcheck is not skipped and linecheck is not skipped and argcheck.rc != 0 and
    linecheck.rc != 0
  tags:
  - CCE-82886-3
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - grub2_ipv6_disable_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Replace existing ipv6.disable argument
  replace:
    path: /etc/default/grub
    regexp: ipv6.disable=[a-zA-Z0-9,]+
    replace: ipv6.disable=1
  when:
  - '"grub2-common" in ansible_facts.packages'
  - argcheck is not skipped and linecheck is not skipped and argcheck.rc == 0 and
    linecheck.rc == 0
  tags:
  - CCE-82886-3
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - grub2_ipv6_disable_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Add ipv6.disable argument
  replace:
    path: /etc/default/grub
    regexp: (^\s*GRUB_CMDLINE_LINUX=.*)"
    replace: \1 ipv6.disable=1"
  when:
  - '"grub2-common" in ansible_facts.packages'
  - argcheck is not skipped and linecheck is not skipped and argcheck.rc != 0 and
    linecheck.rc == 0
  tags:
  - CCE-82886-3
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - grub2_ipv6_disable_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

- name: Update grub defaults and the bootloader menu
  command: /sbin/grubby --update-kernel=ALL --args="ipv6.disable=1"
  when: '"grub2-common" in ansible_facts.packages'
  tags:
  - CCE-82886-3
  - PCI-DSS-Req-1.3.1
  - PCI-DSS-Req-1.3.2
  - grub2_ipv6_disable_argument
  - low_disruption
  - low_severity
  - medium_complexity
  - reboot_required
  - restrict_strategy

# Remediation is applicable only in certain platforms
if rpm --quiet -q grub2-common; then

# Correct the form of default kernel command line in GRUB
if grep -q '^\s*GRUB_CMDLINE_LINUX=.*ipv6.disable=.*"'  '/etc/default/grub' ; then
       # modify the GRUB command-line if an ipv6.disable= arg already exists       sed -i "s/\(^\s*GRUB_CMDLINE_LINUX=\".*\)ipv6.disable=[^[:space:]]\+\(.*\"\)/\1ipv6.disable=1\2/"  '/etc/default/grub'
# Add to already existing GRUB_CMDLINE_LINUX parameters
elif grep -q '^\s*GRUB_CMDLINE_LINUX='  '/etc/default/grub' ; then
       # no ipv6.disable=arg is present, append it
       sed -i "s/\(^\s*GRUB_CMDLINE_LINUX=\".*\)\"/\1 ipv6.disable=1\"/"  '/etc/default/grub'
# Add GRUB_CMDLINE_LINUX parameters line
else
       echo "GRUB_CMDLINE_LINUX=\"ipv6.disable=1\"" >> '/etc/default/grub'
fi
grubby --update-kernel=ALL --args=ipv6.disable=1

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ensure IPv6 is disabled through kernel boot parameter

Description

Rationale

Remediation - OS Build Blueprint

Remediation - Ansible

Remediation - Shell Script