Check if the module is loaded
IPv6 functionality is being made available to the system by the ipv6 kernel module. To check if this module is currently loaded in your system, issue the following command as root:
lsmod | grep ipv6
If you see ipv6 in its output, then the module is loaded.
Performing this check is absolutely not necessary. It is included in this article for completeness.
Disable IPv6
You can prevent a module from being inserted into the kernel by either blacklisting it or by completely disabling it.
In this case, since you will most probably turn off the IPv6 firewall (ip6tables) as well, it is highly recommended to completely disable the ipv6 module, to avoid any accidental loading of the IPv6 stack without any firewall protection at the same time.
How the module blacklist works
This information about blacklisting a kernel module exists here for educational purposes. It has been mentioned above that for ipv6 it is important to completely disable it.
From the modprobe.conf man page:
Modules can contain their own aliases: usually these are aliases describing the devices they support, such as “pci:123…”. These “internal” aliases can be overridden by normal “alias” keywords, but there are cases where two or more modules both support the same devices, or a module invalidly claims to support a device: the blacklist keyword indicates that all of that particular module’s internal aliases are to be ignored.
So, blacklist indicates that a module’s aliases should be ignored. But, what happens if an application requires to load that specific module or if root uses modprobe to load it on demand? Let’s test it…
To blacklist the module, simply save the following line in a file inside /etc/modprobe.d:
blacklist ipv6
Next, disable any services that use IPv6, eg ip6tables or any IPv6-enabled network interfaces and reboot (mandatory).
After you’ve logged-in again, try, for example, to load the ipv6 module with the modprobecommand (as root):
[root@centos]# modprobe -v ipv6 insmod /lib/modules/2.6.18-53.1.14.el5/kernel/net/ipv6/ipv6.ko [root@centos]# lsmod | grep v6 ipv6 251393 8
The blacklisted module has been loaded. This is what happens if it is needed by a system service, regardless of the fact that it has been blacklisted. In the case of ipv6 this could be a security risk, provided that the ipv6 firewall has been turned off but some network interfaces still use IPv6. So, frankly, it is suggested to read on how to disable the module more aggressively…
Completely disable the ipv6 module
To completely disable IPv6 in your system, all you have to do is save the following line in a file inside /etc/modprobe.d/.
install ipv6 /bin/true
The above line means: whenever the system needs to load the ipv6 kernel module, it is forced to execute the command true instead of actually loading the module. Since /bin/true, does absolutely nothing, the module never gets loaded.
Again, it is required to reboot for the changes to take effect.
It is obvious that this is an aggressive method to disable kernel modules, but it guarantees that the module never gets loaded.
This is the recommended way to disable IPv6.
Other Configuration Tasks
Since the IPv6 functionality has been disabled, you can disable the ip6tables service (IPv6 Firewall). Issue the following command as root:
chkconfig ip6tables off
It is also a good idea, since the ip6tables service has been turned off, to disable any IPv6-related functionality in the network interface configuration. Even if you do not do this, the IPv6 stack will not be initialized because the ipv6 module cannot be loaded. But, generally, you could set the following options to “no” inside your network interface scripts, for example:/etc/sysconfig/network-scripts/ifcfg-eth0
IPV6INIT=no IPV6_AUTOCONF=no
Finally, In fedora 8 or newer you can safely remove the following option from the /etc/sysconfig/network file, if it exists:
NETWORKING_IPV6=no
No comments:
Post a Comment