On 3/25/14, 4:55 PM, Frank Caviggia wrote:
Shawn,

In general the White House mandate on IPv6 is gaining traction - the National Laboratories, Universities, and some DoD agencies (DTRA) are running with the mandate. I would recommend that IPv6 be left on as long as ip6tables/firewall is running. Perhaps a RHEL 7 STIG requirement?

Perhaps I read the original email to hastily. In regards to SSG recommendations, it calls out to turn off IPv6 only if it's not needed. e.g.:

<Rule id="kernel_module_ipv6_option_dis!
 abled" severity="medium">
....
<rationale>
Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
the vulnerability to exploitation.
</rationale>
....
</Rule>

Then, if you are using IPv6, gives a slew of recommendations (note ".... if necessary"):
<Group id="configuring_ipv6">
<title>Configure IPv6 Settings if Necessary</title>
<description>A major feature of IPv6 is the extent to which systems
implementing it can automatically configure their networking
devices using information from the network. From a security
perspective, manually configuring important configuration
information is preferable to accepting it from the network
in an unauthenticated fashion.</description>

The various <rule>'s only state to turn of IPv6 if there's no need for it -- not to turn it off completely!