On 3/25/14, 4:55 PM, Frank Caviggia
wrote:
Shawn,
In general the White House mandate on IPv6 is gaining traction - the National Laboratories, Universities, and some DoD agencies (DTRA) are running with the mandate. I would recommend that IPv6 be left on as long as ip6tables/firewall is running. Perhaps a RHEL 7 STIG requirement?
Perhaps I read the original email to hastily. In regards to SSG
recommendations, it calls out to turn off IPv6 only if it's not
needed. e.g.:
<Rule id="kernel_module_ipv6_option_dis!
abled" severity="medium">
....
<rationale>
Any unnecessary network stacks - including IPv6 - should be disabled, to reduce
the vulnerability to exploitation.
</rationale>
....
</Rule>
Then, if you are using IPv6, gives a slew of recommendations (note
".... if necessary"):
<Group id="configuring_ipv6">
<title>Configure IPv6 Settings if Necessary</title>
<description>A major feature of IPv6 is the extent to which systems
implementing it can automatically configure their networking
devices using information from the network. From a security
perspective, manually configuring important configuration
information is preferable to accepting it from the network
in an unauthenticated fashion.</description>
The various <rule>'s only state to turn of IPv6 if there's no
need for it -- not to turn it off completely!