cis-ubuntu1804-v220-3-1-1

name	cis-ubuntu1804-v220-3-1-1
description	Ensure IPv6 status is identified
category	cis-networking
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","networking","ipv6"]
cis_id	3.1.1
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 3.1.1

Description

If IPv6 is to be used in the environment, or the system has IPv6 enabled, ensure that it is configured properly.

If IPv6 is not to be used in the environment, disable it to reduce the attack surface of the system.

Rationale

If IPv6 or dual stack is not to be used, it is recommended that IPv6 be disabled to reduce the attack surface of the system.

Impact

Required network connectivity may be impacted. Consult the documentation for the environment to determine if IPv6 is required.

Audit Procedure

Command Line

Run the following script to verify IPv6 status is identified:

#!/usr/bin/bash
{
  grubfile=$(find /boot -type f \( -name 'grubenv' -o -name 'grub.conf' -o -name 'grub.cfg' \) -exec grep -Pl -- '^\h*(kernelopts=|linux|kernel)' {} \;)
  searchloc="/run/sysctl.d/*.conf /etc/sysctl.d/*.conf /usr/local/lib/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf /etc/sysctl.conf"

  if [ -s "$grubfile" ]; then
    ! grep -P -- "^\h*(kernelopts=|linux|kernel)" "$grubfile" | grep -vq -- ipv6.disable=1 && echo -e "\nIPv6 Disabled in \"$grubfile\""
  fi

  if grep -Pqs -- "^\h*net\.ipv6\.conf\.all\.disable_ipv6\h*=\h*1\h*(#.*)?$" $searchloc && \
     grep -Pqs -- "^\h*net\.ipv6\.conf\.default\.disable_ipv6\h*=\h*1\h*(#.*)?$" $searchloc && \
     sysctl net.ipv6.conf.all.disable_ipv6 | grep -Pqs -- "=\h*1\b" && \
     sysctl net.ipv6.conf.default.disable_ipv6 | grep -Pqs -- "=\h*1\b"; then
    echo -e "\nIPv6 Disabled via sysctl"
  fi

   [ ! -s  ] && ! grep -Pqs --   && ! grep -Pqs --  ; 
     -e 
  
}