6

Note: This question is still unresolved - the answer was auto-accepted.

I have a Debian Lenny VPS, that's running virtualized by Parallels/Virtuozzo. Currently, the network interface doesn't have an IPv6 address - and that's good, because I don't have an ip6tables configuration.

But I assume, that I could wake up one day, and ifconfig will show me an ipv6 address for the interface - because I have no control over the kernel or its modules - they're under the control of the hosting company. That would leave the server completely vulnerable to attacks from IPv6 addresses.

What would be the best way to disable IPv6 (for the interface or maybe for the entire host)? Usually I would simply disable the kernel module, but that's not possible in this case.

Update

Maybe I should add, that I can use iptables and everything normally (I'm root on the VPS), but I can't make changes to the kernel or load kernel modules because of the way Virtuozzo works (shared kernel).

lsmod always returns nothing.

I can't call ip6tables -L (it says that I need to insmod, or that the kernel would have to be upgraded).

I don't think, that changes to /etc/modprobe.d/aliases would have any effect, or do they?

Networking Config?

I thought, that maybe I can turn IPv6 off from /etc/network/... Is that possible?

Improve this question
6
  • Can you edit anything /etc/modprobe.d/ ?
    – kbyrd
    Apr 10, 2010 at 18:57
  • @kbyrd Yes I'm root on the VPS, so no restrictions there - but I must admit, that I have no idea, if changes in this directory will have any effect?
    – Chris Lercher
    Apr 10, 2010 at 19:29
  • I deleted my comment, that won't work if you're just in a chroot jail like you said. How do you get access to the firewall rules?
    – kbyrd
    Apr 11, 2010 at 1:46
  • @kbyrd: I'm really not sure, if it could still work! But how can I find out/how would I see if it worked or not? lsmod never shows anything at all. I can call iptables normally.
    – Chris Lercher
    Apr 11, 2010 at 9:45
  • 1
    I noticed nobody explained Avahi, which you mentioned. Avahi is the mDNS service, and only deals with host and service discovery on the network. (Apple calls this Bonjour.) It does not deal with IPv6 address assignment. (Except avahi-autoipd, which does IPv4 link-local address assignment. That doesn't apply to your situation.) Normally, IPv6 addresses are assigned by the kernel automatically (both link-local and through router advertisements).
    – Shtééf
    Apr 17, 2010 at 20:06

10 Answers 10

Reset to default
7
+50

I've only tested this on Ubuntu, but you could try the following:

echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6

And if this appears to work, you can make it permanent by adding the following to /etc/sysctl.conf:

net.ipv6.conf.all.disable_ipv6=1
Improve this answer
4
  • @Shtééf: Sounds so good! I just thought: That's it :-) Unfortunately, I get bash: disable_ipv6: Operation not permitted, although I call it as root. Virtuozzo specific problem once again, it seems. +1 though, because it was so close :-)
    – Chris Lercher
    Apr 16, 2010 at 19:59
  • Okay, perhaps there's two variations on this you can try. Try setting the option with the command: sysctl net.ipv6.conf.all.disable_ipv6=1. If that still doesn't work, perhaps replace all with the specific interface, for example: sysctl net.ipv6.conf.eth0.disable_ipv6=1
    – Shtééf
    Apr 16, 2010 at 20:04
  • Thanks. Unfortunately no luck, it results in error: "Operation not permitted" setting key "net.ipv6.conf.all.disable_ipv6" etc.
    – Chris Lercher
    Apr 16, 2010 at 20:10
  • Please note: This answer was auto-accepted (I was busy and came too late to accept an answer ... ) I think, that's ok - Shtééf deserves the bounty, because I learned something new from this answer.
    – Chris Lercher
    Apr 23, 2010 at 13:32
1

Best solution is to set up an iptables config that covers v6.

Failing that, most daemons will let you specify interfaces addresses to bind to, with default of all. Explicitly list the v4 addresses you want, and then they won't leave open ports on v6 addresses, should you later get any. Outgoing connections would still prefer v6 addresses, though.

Improve this answer
2
  • Thanks! Setting up an ip6tables config is definitely the solution I have planned, if I can't disable IPv6 in a more general way. I just think, that it's a bit of unnecessary overhead and maybe even additional risk, and would prefer if I could disable it on the network interface level. Applications should ideally have no chance to bind on IPv6.
    – Chris Lercher
    Apr 10, 2010 at 19:54
  • I found out in the meantime, that I can't even call the ip6tables command. So this is unfortunately not an option.
    – Chris Lercher
    Apr 16, 2010 at 8:13
1

There's a fairly simple way to not be vulnerable to attack on IPv6.

Don't have services listening that shouldn't be open to the world. At the very least simply forcing services to bind to a specific IPv4 address should ensure they're not listening on IPv6. netstat -tupl can help with this.

Firewalls should exist for two reasons: * Protecting services with limited access to the world (TCP wrappers also helps here) * Protecting you from your own mistakes

Improve this answer
2
  • 1
    @LapTop006: I agree partially. But there are exceptions, e.g.: What about non-privileged users starting a service? Without a firewall, an attacker won't need to gain root permissions.
    – Chris Lercher
    Apr 14, 2010 at 19:05
  • That would still require the non privileged user to be able to access the system enough to do that. Which will not be any easier in the case an ipv6 address appears with NO services listening on it
    – rackandboneman
    May 9, 2012 at 23:41
1

I believe currently the best way to disable IPv6 in Debian Lenny is to create a file in /etc/modprobe.d named ipv6.conf with blacklist ipv6 in it, then run depmod -ae as root, followed by update-initramfs -u.

There is a write-up on this on the debian.org wiki here: http://wiki.debian.org/KernelModuleBlacklisting

Good luck!

--jed

Improve this answer
5
  • @Jed: I'm not sure, if this works on my VPS, since lsmod always returns nothing?
    – Chris Lercher
    Apr 16, 2010 at 17:10
  • @chris_l lsmod shows nothing relating to ipv6 on any of my debian based systems either, but I'm certain that this method works. You could also try creating a blacklist file as described in the debian docs: debian.org/doc/manuals/debian-reference/…, but my guess is the wiki is more up to date (both methods probably work).
    – Jed Daniels
    Apr 16, 2010 at 17:36
  • On my usual systems, modprobe -l shows a long list of modules. On my VPS however, I get zero modules. I have the feeling, that everything is compiled directly into the kernel, instead of using modules. Or that I simply have no access to the modules list. Since it's impossible to change the kernel, I assumed, that it's also impossible to change the modules for a Virtuozzo system - but I could be wrong. How can I find out?
    – Chris Lercher
    Apr 16, 2010 at 19:01
  • @chris_l "How can I find out?" Can you ask your VPS provider?
    – Jed Daniels
    Apr 16, 2010 at 19:23
  • I don't have official support there, because I only got the entry level VPS, but I can try to ask them on Monday. But I think this kind of setup is typical for Virtuozzo systems - I have seen it on one other system from a different provider, too.
    – Chris Lercher
    Apr 16, 2010 at 19:30
1

Going out on a limb here, but wouldn't the host provider communicate any potential kernel changes like this to it's customers? Have you experienced anything (kernel upgrade, etc.) that would lead you to believe that this would happen without advanced notice? Also, are they even routing IPv6 traffic to/from their network? Might be best just to express your concern to support and go from there.

Improve this answer
2
  • 1
    +1, because the provider is pretty good at communicating changes, and maybe I really should talk about my concerns on their forum. However, since the effects could be dramatic if I miss the notice for some reason, I'd strongly prefer to solve this problem directly on my server.
    – Chris Lercher
    Apr 16, 2010 at 17:14
  • I'd voice your concerns with them -- they may also be able to disable it for you.
    – gravyface
    Apr 16, 2010 at 20:19
1

I can't test it on debian right now, but on Redhat you can modify the /etc/sysconfig/network file and add "NETWORKING_IPV6=no"

Improve this answer
3
  • Thanks, I think this goes into the right direction. I would like to find something like that for Debian (there's no /etc/sysconfig).
    – Chris Lercher
    Apr 16, 2010 at 18:55
  • hmmm... I looked into this more and it looks like if you can modify the grub config you can add "ipv6.disable = 1" to your kernel options to disable ipv6.
    – nbartolomeo
    Apr 16, 2010 at 19:32
  • Good idea! But there's no grub or lilo on the system (/boot is empty). It's all a little bit different because of Virtuozzo..
    – Chris Lercher
    Apr 16, 2010 at 19:38
0

Not sure if this will help but OpenVZ (Virtuozzo open source) does not seem to support IPv6.

Improve this answer
5
  • OpenVZ actually supports IPv6.
    – PowerSp00n
    Apr 12, 2010 at 8:53
  • According to their own wiki linked in my answer, it is not fully supported.
    – sybreon
    Apr 13, 2010 at 6:56
  • I can't decide, which virtualization sulution (e.g. OpenVZ) is installed on the machine. I just have one VPS on the machine...
    – Chris Lercher
    Apr 13, 2010 at 9:31
  • huh? if you can find a '/proc/user_beancounters' then it would be a VZ based system.
    – sybreon
    Apr 13, 2010 at 17:25
  • I think I understand what you mean - but what I can't decide is, when they will upgrade to a newer version of Virtuozzo, that will support IPv6. That's what I'm afraid of: One day, suddenly IPv6 might be enabled...
    – Chris Lercher
    Apr 16, 2010 at 8:02
0

Wouldn't blocking everything in ip6tables solve your problem? It also allows you to implement ipv6 iptables whenever you'd want to without having to enable ipv6 again.

Improve this answer
2
  • @HannesFostie: The question is: How can I do that, when I can't call ip6tables (see my question for more details)? I could maybe insert some calls on startup, that would simply fail until ip6tables works, but that wouldn't fit very nicely with the /etc/init.d/iptables script that came pre-installed with the server (based on iptables-restore). And since I can't test that ip6tables setup, it also doesn't feel quite right.
    – Chris Lercher
    Apr 16, 2010 at 12:50
  • I'm sorry, must've missed it.
    – HannesFostie
    Apr 16, 2010 at 13:08
0

Another option is to configure some totally bogus IPv6 settings so even if the provider does enable it, it won't work on this system at all (yes, it is super kludgy, but it would work to prevent anyone from doing anything with IPv6 on your system).

Good luck,

--jed

Improve this answer
0

ip route del ::/0

take away the default route which will effectively break IPv6 connectivity.

Improve this answer
1
  • Doesnt help for link-local communication. As we're talking about Virtuozzo here, it's not uncommon to find some thousand virtual machines in one large layer 2. (I guess thats what they call the cloud...)
    – Michuelnik
    Jul 20, 2012 at 19:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .