The check RHEL6/input/checks/sysctl_net_ipv6_disabled.xml is a duplicate of RHEL6/input/checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml. Since sysctl_net_ipv6_conf_all_disable_ipv6.xml matches the type and formatting of all the other sysctl checks, it seems that sysctl_net_ipv6_disabled.xml is the one to delete.

[shawn@rhel6 input]$ pwd /var/www/html/scap-security-guide/RHEL6/input [shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_disabled * checks/sysctl_net_ipv6_disabled.xml:2: <definition class="compliance" id="sysctl_net_ipv6_disabled" version="1"> [shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_conf_all_disable_ipv6 * checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:2: <definition class="compliance" id="sysctl_net_ipv6_conf_all_disable_ipv6" version="1"> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:13: <criterion comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" test_ref="test_sysctl_net_ipv6_conf_all_disable_ipv6" /> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:17: <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" id="test_sysctl_net_ipv6_conf_all_disable_ipv6" version="1"> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:18: <unix:object object_ref="object_sysctl_net_ipv6_conf_all_disable_ipv6" /> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:19: <unix:state state_ref="state_sysctl_net_ipv6_conf_all_disable_ipv6" /> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:22: <unix:sysctl_object id="object_sysctl_net_ipv6_conf_all_disable_ipv6" version="1"> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:26: <unix:sysctl_state id="state_sysctl_net_ipv6_conf_all_disable_ipv6" version="1">

On 05/13/2013 03:24 PM, Shawn Wells wrote: > On 5/13/13 1:54 PM, Maura Dailey wrote: >> The check RHEL6/input/checks/sysctl_net_ipv6_disabled.xml is a >> duplicate of >> RHEL6/input/checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml. Since >> sysctl_net_ipv6_conf_all_disable_ipv6.xml matches the type and >> formatting of all the other sysctl checks, it seems that >> sysctl_net_ipv6_disabled.xml is the one to delete. > > > Actually, I think they both should be deleted. Neither is being > called from an XCCDF rule: >> [shawn@rhel6 input]$ pwd >> /var/www/html/scap-security-guide/RHEL6/input >> >> [shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_disabled * >> checks/sysctl_net_ipv6_disabled.xml:2: <definition >> class="compliance" id="sysctl_net_ipv6_disabled" version="1"> >> >> [shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_conf_all_disable_ipv6 * >> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:2: <definition >> class="compliance" id="sysctl_net_ipv6_conf_all_disable_ipv6" >> version="1"> >> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:13: <criterion >> comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set >> to 1" test_ref="test_sysctl_net_ipv6_conf_all_disable_ipv6" /> >> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:17: >> <unix:sysctl_test check="all" check_existence="all_exist" >> comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set >> to 1" id="test_sysctl_net_ipv6_conf_all_disable_ipv6" version="1"> >> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:18: <unix:object >> object_ref="object_sysctl_net_ipv6_conf_all_disable_ipv6" /> >> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:19: <unix:state >> state_ref="state_sysctl_net_ipv6_conf_all_disable_ipv6" /> >> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:22: >> <unix:sysctl_object >> id="object_sysctl_net_ipv6_conf_all_disable_ipv6" version="1"> >> checks/sysctl_net_ipv6_conf_all_disable_ipv6.xml:26: >> <unix:sysctl_state id="state_sysctl_net_ipv6_conf_all_disable_ipv6" >> version="1"> > > IIRC, these rules existed before we disabled IPv6 in the kernel & > modprobe via "Disable IPv6 Networking Support Automatic Loading" and > "Disable Interface Usage of IPv6." Is there any reason why we'd also > disable this in sysctl? That thought also occurred to me. I'd think that the only reason to check for both is if both achieve the same effect equally well (in which case, the checks should probably be combined in an OR), or if we specifically wanted to give users that used sysctl checks from previous security guidance to get a pass.

Yes. One of these should go. We have this, but it states that this sysctl causes "almost all of the calls into the module" to be disabled. https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17 So the kernel module option seems stronger. And would suggest we delete both sysctls. Perhaps somebody from Red Hat engineering can offer an opinion. On Mon, May 13, 2013 at 3:50 PM, Shawn Wells <shawn(a)redhat.com&gt; wrote: > On 5/13/13 3:43 PM, Maura Dailey wrote: > >> On 05/13/2013 03:24 PM, Shawn Wells wrote: >> >>> On 5/13/13 1:54 PM, Maura Dailey wrote: >>> >>>> The check RHEL6/input/checks/sysctl_net_**ipv6_disabled.xml is a >>>> duplicate of RHEL6/input/checks/sysctl_net_** >>>> ipv6_conf_all_disable_ipv6.**xml. Since sysctl_net_ipv6_conf_all_**disable_ipv6.xml >>>> matches the type and formatting of all the other sysctl checks, it seems >>>> that sysctl_net_ipv6_disabled.xml is the one to delete. >>>> >>> >>> >>> Actually, I think they both should be deleted. Neither is being called >>> from an XCCDF rule: >>> >>>> [shawn@rhel6 input]$ pwd >>>> /var/www/html/scap-security-**guide/RHEL6/input >>>> >>>> [shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_disabled * >>>> checks/sysctl_net_ipv6_**disabled.xml:2: <definition >>>> class="compliance" id="sysctl_net_ipv6_disabled" version="1"> >>>> >>>> [shawn@rhel6 input]$ grep -rin sysctl_net_ipv6_conf_all_**disable_ipv6 >>>> * >>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:2: <definition >>>> class="compliance" id="sysctl_net_ipv6_conf_all_**disable_ipv6" >>>> version="1"> >>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:13: <criterion >>>> comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" >>>> test_ref="test_sysctl_net_**ipv6_conf_all_disable_ipv6" /> >>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:17: >>>> <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel >>>> runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" >>>> id="test_sysctl_net_ipv6_conf_**all_disable_ipv6" version="1"> >>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:18: <unix:object >>>> object_ref="object_sysctl_net_**ipv6_conf_all_disable_ipv6" /> >>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:19: <unix:state >>>> state_ref="state_sysctl_net_**ipv6_conf_all_disable_ipv6" /> >>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:22: >>>> <unix:sysctl_object id="object_sysctl_net_ipv6_**conf_all_disable_ipv6" >>>> version="1"> >>>> checks/sysctl_net_ipv6_conf_**all_disable_ipv6.xml:26: >>>> <unix:sysctl_state id="state_sysctl_net_ipv6_**conf_all_disable_ipv6" >>>> version="1"> >>>> >>> >>> IIRC, these rules existed before we disabled IPv6 in the kernel & >>> modprobe via "Disable IPv6 Networking Support Automatic Loading" and >>> "Disable Interface Usage of IPv6." Is there any reason why we'd also >>> disable this in sysctl? >>> >> >> That thought also occurred to me. I'd think that the only reason to >> check for both is if both achieve the same effect equally well (in which >> case, the checks should probably be combined in an OR), or if we >> specifically wanted to give users that used sysctl checks from previous >> security guidance to get a pass. >> > > Other rules already exist to disable IPv6 at the kernel and module > levels. There seems little value to duplicate this through yet another > sysctl check. > > Anyone from the community have opinions? > > > ______________________________**_________________ > scap-security-guide mailing list > scap-security-guide@lists.**fedorahosted.org&lt;scap-security-guide(a)lists.fedorahosted.org&gt; > https://lists.fedorahosted.**org/mailman/listinfo/scap-**security-guide&l... >

On 5/13/13 7:32 PM, Jeffrey Blank wrote: Yes. One of these should go. We have this, but it states that this sysctl causes "almost all of the calls into the module" to be disabled. https://bugzilla.redhat.com/show_bug.cgi?id=641836#c17 So the kernel module option seems stronger. And would suggest we delete both sysctls. Perhaps somebody from Red Hat engineering can offer an opinion. Nice BZ link -- didn't know about the level of integration. Created https://fedorahosted.org/scap-security-guide/ticket/408 to track the creation of XCCDF against the sysctl_net_ipv6_conf_all_disable_ipv6 Anyone want to grab that ticket? Actually, if someone has been thinking about diving into content creation, I'd be happy to step through the process with them. _______________________________________________ scap-security-guide mailing list scap-security-guide(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide