# Ensure IPv6 status is identified

Necessity: While IPv6 is the future of internet addressing, many internal networks are not configured to use or monitor it. An enabled but unused IPv6 stack can expose a system to network-based attacks that bypass IPv4-centric security controls. Disabling IPv6 when not required adheres to the principle of least functionality, reducing the system's overall attack surface and simplifying network security management. Risks of misconfiguration include exposure to IPv6-specific vulnerabilities and unauthorized network bridging.

Auditing and Remediation: The audit script provides a definitive status of IPv6 by checking the two primary methods of control in CentOS: kernel parameters via `sysctl` and boot-time parameters via GRUB. The remediation script modifies these same controls to enforce the desired state, ensuring that the setting is persistent across reboots.

Recommended State Rationale: The recommendation is consistently 'Disabled' across Basic, Moderate, and Strict levels. This is based on the security best practice of disabling any protocol that is not explicitly required for business operations. There is no intermediate state between enabled and disabled. If an organization has fully deployed, secured, and monitored IPv6, the recommended state should be 'Enabled'. However, for the vast majority of systems where this is not the case, disabling it is the most secure posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if IPv6 is disabled. The script should inspect the `sysctl` values for `net.ipv6.conf.all.disable_ipv6` and `net.ipv6.conf.default.disable_ipv6`, as well as the active kernel command line for the `ipv6.disable=1` parameter. If any of these configurations indicate that IPv6 is disabled, the script must return the string 'Disabled'. Otherwise, it must return 'Enabled'. The output must consist solely of one of these two strings.

## Remediation Script Working

Bash script that accepts a single positional argument: 'Enabled' or 'Disabled'. If the argument is 'Disabled', the script must set `net.ipv6.conf.all.disable_ipv6=1` and `net.ipv6.conf.default.disable_ipv6=1` in a persistent `sysctl` configuration file and add `ipv6.disable=1` to the `GRUB_CMDLINE_LINUX` entry in `/etc/default/grub`, then rebuild the GRUB configuration. If the argument is 'Enabled', it must perform the reverse actions. The script must return 'true' on successful application of the state and 'false' on any failure.

