[Patch] Duplicate Check for Disabling IPv6

Jeffrey Blank blank at eclipse.ncsc.mil
Tue May 14 03:54:05 UTC 2013


I'm not suggesting we do that at all.  I'm disagreeing with Dan Walsh and
suggesting that the IPv6 attack surface is smaller if we use kernel module
options.


On Mon, May 13, 2013 at 11:06 PM, Shawn Wells <shawn at redhat.com> wrote:

>  On 5/13/13 7:32 PM, Jeffrey Blank wrote:
>
> Yes. One of these should go.
>
>  We have this, but it states that this sysctl causes "almost all of the
> calls into the module" to be disabled.
> https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17
>
>  So the kernel module option seems stronger.  And would suggest we delete
> both sysctls.  Perhaps somebody from Red Hat engineering can offer an
> opinion.
>
>
> Nice BZ link -- didn't know about the level of integration.
>
> Created https://fedorahosted.org/scap-security-guide/ticket/408 to track
> the creation of XCCDF against the sysctl_net_ipv6_conf_all_disable_ipv6
>
> Anyone want to grab that ticket? Actually, if someone has been thinking
> about diving into content creation, I'd be happy to step through the
> process with them.
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130513/3214f85a/attachment-0001.html>


More information about the scap-security-guide mailing list