# Ensure IPv6 status is identified

Necessity: The IPv6 protocol, while intended as the successor to IPv4, can introduce significant security risks if not properly configured and monitored. Many networks and security tools are still primarily focused on IPv4, leaving IPv6 as a potential blind spot. An enabled but unmanaged IPv6 stack can be exploited by attackers to bypass firewalls, intrusion detection systems, and other security controls, creating an alternate path into the network. Disabling IPv6 when it is not explicitly required is a critical security measure that reduces the system's attack surface, adhering to the principle of least functionality.

Auditing and Remediation: The audit script checks the system's current IPv6 status by reading the 'net.ipv6.conf.all.disable_ipv6' kernel parameter. A value of '0' indicates IPv6 is enabled, while '1' indicates it is disabled. The remediation script modifies this kernel parameter to either enable or disable IPv6 and ensures the configuration persists across system reboots by writing the setting to a file in '/etc/sysctl.d/'.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is ['1'], which corresponds to disabling IPv6. This is a binary setting with a clear security implication. Unless there is a specific, documented operational need for IPv6, it should be disabled to minimize risk. This recommendation aligns with security benchmarks like CIS, which advise disabling protocols and services that are not in use. There is no graduated scale of security for this setting; the most secure posture for a system not requiring IPv6 is to have it turned off completely.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the value of the 'net.ipv6.conf.all.disable_ipv6' kernel parameter using 'sysctl'. The script must parse the output and return only the numeric value ('0' for enabled, '1' for disabled) without any additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument ('0' for enabled, '1' for disabled) to set the 'net.ipv6.conf.all.disable_ipv6' kernel parameter. The script must update the running configuration using 'sysctl -w' and also ensure the setting is persistent by adding or updating the entry in a file within '/etc/sysctl.d/' (e.g., '99-sysctl.conf'). The script must return 'true' upon successful application of the setting, and 'false' otherwise.

