lownetworkverified ✓

Ensure IPv6 status is identified

ipv6-status-identified · RHEL ≥ 8 · 1 impl

Description

The system's IPv6 posture must be an explicit, deliberate configuration: the net.ipv6.conf.all.disable_ipv6 setting should be present in a sysctl configuration file so IPv6 is knowingly enabled or disabled rather than left at the kernel default.

Rationale

An unmanaged IPv6 stack can carry traffic that bypasses IPv4-only controls. Recording an explicit decision ensures IPv6 exposure is understood and governed.

Check → Remediate

Checkcommand

if grep -rqsE '^\s*net\.ipv6\.conf\.all\.disable_ipv6\s*=' /etc/sysctl.conf /etc/sysctl.d/ 2>/dev/null; then
  echo "OK: IPv6 status is explicitly configured"
  exit 0
fi
echo "FAIL: no explicit net.ipv6.conf.all.disable_ipv6 setting; IPv6 status not identified"
exit 1

expected_exit:: 0

Remediatemanual

note:: Decide whether IPv6 is required. Record the decision explicitly by setting net.ipv6.conf.all.disable_ipv6 (0 to keep, 1 to disable) in /etc/sysctl.d/ and applying with sysctl --system.

Framework references

CIS

rhel9 3.1.1rhel8 3.1.1rhel10 3.1.1

NIST 800-53

CM-7SC-7

Live verification

rhel9:check

#ipv6#network#sysctl