3.7 Disable IPv6

Information

Although IPv6 has many advantages over IPv4, not all organizations have IPv6 or dual stack configurations implemented.

Rationale:

If IPv6 or dual stack is not to be used, it is recommended that IPv6 be disabled to reduce the attack surface of the system.

Solution

Edit /etc/default/grub and add ipv6.disable=1 to the GRUB_CMDLINE_LINUX parameters:

GRUB_CMDLINE_LINUX='ipv6.disable=1'

Run the following command to update the grub2 configuration:

# update-grub

See Also

https://workbench.cisecurity.org/files/2619

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv6|3.7, CSCv7|9.2

Plugin: Unix

Control ID: 3ab8e229fdfca7cb02243c7855891ca9e089ba95cba0f931fe55517ed390be1a