{
  "id": "CB-UBU-NET-001",
  "standard": "ubuntu",
  "version": "0.1.2",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-NET-001",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-NET-001.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-NET-001.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-NET-001",
    "title": "Decide whether IPv6 is used, and disable or secure it accordingly",
    "finding": {
      "title": "IPv6 is active without a decision to use it",
      "description": "An IPv6 stack nobody planned for is often left unfiltered and unmonitored, next to a hardened IPv4 configuration."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "ipv6",
      "network"
    ],
    "description": "Ubuntu enables IPv6 by default: every interface gets a link-local address, and a global address\nas soon as a router advertises a prefix. Each system must have a recorded decision: either IPv6\nis used, and it is configured and filtered like IPv4, or it is not, and the stack is disabled.\n",
    "rationale": "Firewall rules, monitoring and hardening are often written for IPv4 only. An IPv6 stack left on\nby default gives an attacker on the local network a second, less watched path to the system\n(router advertisements, link-local services).\n",
    "impact": "Disabling IPv6 breaks software that expects `::1` or IPv6 sockets. Check local services after the\nchange.\n",
    "notes": "The IPv6 sysctl controls of this standard only apply when the IPv6 stack is present, through the\n`ipv6` fact.\n",
    "audit": {
      "manual": "1. Find whether IPv6 is enabled: `test -d /proc/sys/net/ipv6 && sysctl net.ipv6.conf.all.disable_ipv6`\n   (`0` means enabled), and list addresses with `ip -6 address`.\n2. Check the system documentation for a decision on IPv6 for this host.\n3. If IPv6 is used, check that the firewall also filters IPv6 (`ufw status verbose` with\n   `IPV6=yes` in `/etc/default/ufw`, the Ubuntu default, or an `inet`/`ip6` table in `nft list ruleset`).\n"
    },
    "remediation": {
      "manual": "- If IPv6 is not used, add `ipv6.disable=1` to `GRUB_CMDLINE_LINUX` in `/etc/default/grub`,\n  run `update-grub` and reboot. Without access to the boot loader, set\n  `net.ipv6.conf.all.disable_ipv6 = 1` and `net.ipv6.conf.default.disable_ipv6 = 1` in\n  `/etc/sysctl.d/60-cirsec.conf` instead. With netplan, also set `link-local: [ ipv4 ]` (or `[]`)\n  on each interface so that it does not ask for IPv6 addresses.\n- If IPv6 is used, apply the IPv6 controls of this standard and filter IPv6 in the firewall.\n- Record the decision in the system documentation.\n",
      "rollback": "Remove `ipv6.disable=1` or the `disable_ipv6` lines, then reboot.\n"
    },
    "references": [
      {
        "title": "Linux kernel documentation - IP Sysctl (disable_ipv6)",
        "url": "https://docs.kernel.org/networking/ip-sysctl.html",
        "publisher": "The Linux Kernel Organization",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R13)",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R13",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1557"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-NET-014",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}