Decide whether IPv6 is used, and disable or secure it accordingly

Description

Debian enables IPv6 by default: every interface gets a link-local address, and a global address as soon as a router advertises a prefix. Each system must have a recorded decision: either IPv6 is used, and it is configured and filtered like IPv4, or it is not, and the stack is disabled.

The IPv6 sysctl controls of this standard only apply when the IPv6 stack is present, through the ipv6 fact.

Rationale

Firewall rules, monitoring and hardening are often written for IPv4 only. An IPv6 stack left on by default gives an attacker on the local network a second, less watched path to the system (router advertisements, link-local services).

Impact

Disabling IPv6 breaks software that expects ::1 or IPv6 sockets. Check local services after the change.

Audit

1. Find whether IPv6 is enabled: test -d /proc/sys/net/ipv6 && sysctl net.ipv6.conf.all.disable_ipv6 (0 means enabled), and list addresses with ip -6 address.
2. Check the system documentation for a decision on IPv6 for this host.
3. If IPv6 is used, check that the firewall also filters IPv6 (ufw status verbose with IPV6=yes in /etc/default/ufw, or an inet/ip6 table in nft list ruleset).

Remediation

• If IPv6 is not used, add ipv6.disable=1 to GRUB_CMDLINE_LINUX in /etc/default/grub, run update-grub and reboot. Without access to the boot loader, set net.ipv6.conf.all.disable_ipv6 = 1 and net.ipv6.conf.default.disable_ipv6 = 1 in /etc/sysctl.d/60-cirsec.conf instead.
• If IPv6 is used, apply the IPv6 controls of this standard and filter IPv6 in the firewall.
• Record the decision in the system documentation.

Rollback

Remove ipv6.disable=1 or the disable_ipv6 lines, then reboot.

References

• Linux kernel documentation - IP Sysctl (disable_ipv6) The Linux Kernel Organization, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R13) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-NET-014 Ignore IPv6 router advertisements

People and lifecycle