topic Re: Yank ip6 and tcp6 in Operating System - HP-UX

Yank ip6 and tcp6

Shabu Khan-2 — Thu, 28 Jun 2007 18:57:48 GMT

#HP-UX 11.23
#rp3440

I am trying to do close to what Harry was trying to do here:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=882565

I want all references to IPv6 turned-off, including uninstalling modules ip6 and tcp6.

When I do a lsof | grep -i ipv6 I see a bunch of processes - registrar, kcmond etc listening/using IPv6 address family, we are not using IPV6 and we don't want it on our system.

I see files /dev/tcp6 and /dev/ip6 and kcsystem shows ip6 and tcp6 modules installed, but I want to uninstall these, how do I go about doing it?

I removed files tcp6 and udp6 and ip6 but when it comes back on after a reboot it gets created, obviously because the modules get loaded on reboot and these character files gets created?

Please advise.

Thanks,
Shabu

Re: Yank ip6 and tcp6

Shabu Khan-2 — Fri, 29 Jun 2007 11:32:52 GMT

Any thoughts?

Re: Yank ip6 and tcp6

rick jones — Mon, 02 Jul 2007 12:03:01 GMT

I'm reasonably certain that support for IPv6 in the 11.23 and later TCP/IP stack is not separate from the rest of the stack. That suggests that disabling it entirely may be difficult if not downright impossible.

If you don't actually assign any IPv6 addresses to any of your interfaces, you won't receive any IPv6 traffic from the net. If you are still worried about IPv6, I suppse you could setup ipfilter to filter-out any IPv6 datagrams which somehow managed to make it into your system(s).

Re: Yank ip6 and tcp6

Shabu Khan-2 — Mon, 02 Jul 2007 12:10:16 GMT

Thanks for responding Rick.

Actually, the logic in the /sbin/init.d/ems script could have been better, like I said earlier the script checks to see if the files /dev/ip6 and /dev/tcp6 files exist if it does then it updates the /etc/inetd.conf file to use tcp6 for registrar and starts up the registrar processes with ipv6 and thats why I see those connections to ipv6 address family internally, I don't want to use ipv6 but ipv4.

Thats unfortunate that it is built into the 11.23 OS stack.

We had a PCI audit recently and they asked me to run netstat -an and the output obviously showed stuff listening on ipv6 ports and they asked me to disable it if we are not using any IPV6 addresses.

Thanks,
Shabu

Re: Yank ip6 and tcp6

rick jones — Mon, 02 Jul 2007 12:21:55 GMT

Well, having put-forth my strawman about IPv6 removability, perhaps someone else from UX-land can correct it.