Yes. One of these should go.

We have this, but it states that this sysctl causes "almost all of the calls into the module" to be disabled.
https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17

So the kernel module option seems stronger.  And would suggest we delete both sysctls.  Perhaps somebody from Red Hat engineering can offer an opinion.





On Mon, May 13, 2013 at 3:50 PM, Shawn Wells <shawn@redhat.com> wrote:
On 5/13/13 3:43 PM, Maura Dailey wrote:
On 05/13/2013 03:24 PM, Shawn Wells wrote:
On 5/13/13 1:54 PM, Maura Dailey wrote:
The check RHEL6/input/checks/sysctl_net_ipv6_disabled.xml is a duplicate of RHEL6/input/checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml. Since sysctl_net_ipv6_conf_all_disable_ipv6.xml matches the type and formatting of all the other sysctl checks, it seems that sysctl_net_ipv6_disabled.xml is the one to delete.


Actually, I think they both should be deleted. Neither is being called from an XCCDF rule:
[shawn@rhel6 input]$ pwd
/var/www/html/scap-security-guide/RHEL6/input

[shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_disabled *
checks/sysctl_net_ipv6_disabled.xml:2:  <definition class="compliance" id="sysctl_net_ipv6_disabled" version="1">

[shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_conf_all_disable_ipv6 *
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:2: <definition class="compliance" id="sysctl_net_ipv6_conf_all_disable_ipv6" version="1">
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:13: <criterion comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" test_ref="test_sysctl_net_ipv6_conf_all_disable_ipv6" />
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:17: <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" id="test_sysctl_net_ipv6_conf_all_disable_ipv6" version="1">
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:18: <unix:object object_ref="object_sysctl_net_ipv6_conf_all_disable_ipv6" />
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:19: <unix:state state_ref="state_sysctl_net_ipv6_conf_all_disable_ipv6" />
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:22: <unix:sysctl_object id="object_sysctl_net_ipv6_conf_all_disable_ipv6" version="1">
checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:26: <unix:sysctl_state id="state_sysctl_net_ipv6_conf_all_disable_ipv6" version="1">

IIRC, these rules existed before we disabled IPv6 in the kernel & modprobe via "Disable IPv6 Networking Support Automatic Loading" and "Disable Interface Usage of IPv6." Is there any reason why we'd also disable this in sysctl?

That thought also occurred to me. I'd think that the only reason to check for both is if both achieve the same effect equally well (in which case, the checks should probably be combined in an OR), or if we specifically wanted to give users that used sysctl checks from previous security guidance to get a pass.

Other rules already exist to disable IPv6 at the kernel and module levels. There seems little value to duplicate this through yet another sysctl check.

Anyone from the community have opinions?


_______________________________________________
scap-security-guide mailing list
scap-security-guide@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide