<div dir="ltr">Oh, so also, ACK to Maura&#39;s patch.  We&#39;re only debating about how much further to go, not debating its merits.</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, May 13, 2013 at 7:32 PM, Jeffrey Blank <span dir="ltr">&lt;<a href="mailto:blank@eclipse.ncsc.mil" target="_blank">blank@eclipse.ncsc.mil</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Yes. One of these should go.<div><br></div><div>We have this, but it states that this sysctl causes &quot;<span style="white-space:pre-wrap">almost all of the calls into the module</span>&quot; to be disabled.</div>

<div><a href="https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17</a><br></div><div><br></div><div>So the kernel module option seems stronger.  And would suggest we delete both sysctls.  Perhaps somebody from Red Hat engineering can offer an opinion.</div>

<div><br></div><div><br></div><div><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, May 13, 2013 at 3:50 PM, Shawn Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span> wrote:<br>

<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On 5/13/13 3:43 PM, Maura Dailey wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 05/13/2013 03:24 PM, Shawn Wells wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 5/13/13 1:54 PM, Maura Dailey wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
The check RHEL6/input/checks/sysctl_net_<u></u>ipv6_disabled.xml is a duplicate of RHEL6/input/checks/sysctl_net_<u></u>ipv6_conf_all_disable_ipv6.<u></u>xml. Since sysctl_net_ipv6_conf_all_<u></u>disable_ipv6.xml matches the type and formatting of all the other sysctl checks, it seems that sysctl_net_ipv6_disabled.xml is the one to delete.<br>


</blockquote>
<br>
<br>
Actually, I think they both should be deleted. Neither is being called from an XCCDF rule:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
[shawn@rhel6 input]$ pwd<br>
/var/www/html/scap-security-<u></u>guide/RHEL6/input<br>
<br>
[shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_disabled *<br>
checks/sysctl_net_ipv6_<u></u>disabled.xml:2:  &lt;definition class=&quot;compliance&quot; id=&quot;sysctl_net_ipv6_disabled&quot; version=&quot;1&quot;&gt;<br>
<br>
[shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_conf_all_<u></u>disable_ipv6 *<br>
checks/sysctl_net_ipv6_conf_<u></u>all_disable_ipv6.xml:2: &lt;definition class=&quot;compliance&quot; id=&quot;sysctl_net_ipv6_conf_all_<u></u>disable_ipv6&quot; version=&quot;1&quot;&gt;<br>
checks/sysctl_net_ipv6_conf_<u></u>all_disable_ipv6.xml:13: &lt;criterion comment=&quot;kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1&quot; test_ref=&quot;test_sysctl_net_<u></u>ipv6_conf_all_disable_ipv6&quot; /&gt;<br>


checks/sysctl_net_ipv6_conf_<u></u>all_disable_ipv6.xml:17: &lt;unix:sysctl_test check=&quot;all&quot; check_existence=&quot;all_exist&quot; comment=&quot;kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1&quot; id=&quot;test_sysctl_net_ipv6_conf_<u></u>all_disable_ipv6&quot; version=&quot;1&quot;&gt;<br>


checks/sysctl_net_ipv6_conf_<u></u>all_disable_ipv6.xml:18: &lt;unix:object object_ref=&quot;object_sysctl_net_<u></u>ipv6_conf_all_disable_ipv6&quot; /&gt;<br>
checks/sysctl_net_ipv6_conf_<u></u>all_disable_ipv6.xml:19: &lt;unix:state state_ref=&quot;state_sysctl_net_<u></u>ipv6_conf_all_disable_ipv6&quot; /&gt;<br>
checks/sysctl_net_ipv6_conf_<u></u>all_disable_ipv6.xml:22: &lt;unix:sysctl_object id=&quot;object_sysctl_net_ipv6_<u></u>conf_all_disable_ipv6&quot; version=&quot;1&quot;&gt;<br>
checks/sysctl_net_ipv6_conf_<u></u>all_disable_ipv6.xml:26: &lt;unix:sysctl_state id=&quot;state_sysctl_net_ipv6_<u></u>conf_all_disable_ipv6&quot; version=&quot;1&quot;&gt;<br>
</blockquote>
<br>
IIRC, these rules existed before we disabled IPv6 in the kernel &amp; modprobe via &quot;Disable IPv6 Networking Support Automatic Loading&quot; and &quot;Disable Interface Usage of IPv6.&quot; Is there any reason why we&#39;d also disable this in sysctl?<br>


</blockquote>
<br>
That thought also occurred to me. I&#39;d think that the only reason to check for both is if both achieve the same effect equally well (in which case, the checks should probably be combined in an OR), or if we specifically wanted to give users that used sysctl checks from previous security guidance to get a pass. <br>


</blockquote>
<br></div>
Other rules already exist to disable IPv6 at the kernel and module levels. There seems little value to duplicate this through yet another sysctl check.<br>
<br>
Anyone from the community have opinions?<div><div><br>
<br>
______________________________<u></u>_________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.<u></u>fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.<u></u>org/mailman/listinfo/scap-<u></u>security-guide</a><br>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>