Difference between revisions of "IPv6"

config show IPv6

IPv6=service
   status=enabled
   Gateway=2001:470:79c1:5ff::1

mkdir -p /etc/e-smith/templates-custom/etc/sysctl.conf
nano /etc/e-smith/templates-custom/etc/sysctl.conf/net.ipv6

{
   if ( ($IPv6{status} || 'disabled') ne "enabled" ) {
       $OUT .= "# IPv6 is disabled\n";
       $OUT .= "net.ipv6.conf.all.disable_ipv6 = 1\n";
       $OUT .= "net.ipv6.conf.default.disable_ipv6 = 1\n";
   }
   else {
       $OUT .= "# IPv6 is enabled\n";
       $OUT .= "net.ipv6.conf.all.disable_ipv6 = 0\n";
       $OUT .= "net.ipv6.conf.default.disable_ipv6 = 0\n";
   }
}

mkdir -p /etc/e-smith/templates-custom/etc/sysconfig/network-scripts/ifcfg-ethX
nano /etc/e-smith/templates-custom/etc/sysconfig/network-scripts/ifcfg-ethX/60IPV6

{
if ($IPv6{'status'} eq "enabled") {
   $OUT .= "IPV6INIT=yes";
   $OUT .= "IPV6_AUTOCONF=yes";
   $OUT .= "IPV6_DEFROUTE=yes";
   $OUT .= "IPV6_PEERROUTES=yes";
   $OUT .= "IPV6_FAILURE_FATAL=yes";
   $OUT .= "DNS0=2001:4860:4860::8888"; # Google DNS - you may want to change them!!
   $OUT .= "IPV6_PRIVACY=no";
   } else {
   return "IPV6INIT=no";
}

mkdir -p /etc/e-smith/templates-custom/etc/sysconfig/network-scripts/route-ethX
nano /etc/e-smith/templates-custom/etc/sysconfig/network-scripts/route-ethX/08Gateway

{
   return "" unless (defined $GatewayIP && (
                       ($SystemMode eq 'serveronly' && $InternalInterface{Name} eq $THIS_DEVICE ) ||
                       ($ExternalInterface{Name} eq $THIS_DEVICE) ));
   $OUT .= "$GatewayIP dev $THIS_DEVICE\n";
   $OUT .= "default via $GatewayIP dev $THIS_DEVICE\n";
   if ($IPv6{'status'} eq "enabled") {
       $OUT .= "$IPv6{'Gateway' dev $THIS_DEVICE\n";
       $OUT .= "default via $IPv6{'Gateway'} dev $THIS_DEVICE\n";
   }
}

signal-event post-upgrade;signal-event reboot.

ip addr show eth0

3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
   link/ether ca:94:35:c2:d6:e1 brd ff:ff:ff:ff:ff:ff
   inet 192.168.10.212/24 brd 192.168.10.255 scope global eth0
      valid_lft forever preferred_lft forever
   inet6 2001:470:79c1:5ff:c894:35ff:fec2:d6e1/64 scope global mngtmpaddr dynamic 
      valid_lft 2591951sec preferred_lft 604751sec
   inet6 fe80::c894:35ff:fec2:d6e1/64 scope link 
      valid_lft forever preferred_lft forever

ping6 ipv6.google.com
PING ipv6.google.com(mad06s10-in-x0e.1e100.net (2a00:1450:4003:808::200e)) 56 data bytes
64 bytes from mad06s10-in-x0e.1e100.net (2a00:1450:4003:808::200e): icmp_seq=1 ttl=117 time=56.2 ms
64 bytes from mad06s10-in-x0e.1e100.net (2a00:1450:4003:808::200e): icmp_seq=2 ttl=117 time=55.5 ms

mkdir /etc/e-smith/templates-custom/etc/ssh/sshd_config
nano /etc/e-smith/templates-custom/etc/ssh/sshd_config/15ListenAddress

{
   my $access = $sshd{'access'} || 'private';
   my $address = ($access eq "public") ? "0.0.0.0" : "$LocalIP";
   # Not sure how we allow for 'Local IP only' with IPv6
   # Possibly limit it to the local subnet?
   if ($IPv6{status} eq "enabled") { 
       $OUT .= "ListenAddress ::\n";
       $OUT .= "ListenAddress $address\n";
   } else {
       $OUT .= "ListenAddress $address\n";
   }
}

signal-event remoteaccess-update

ssh root@2001:470:1f13:3ff:2a9:b700:fe99:792c

mkdir -p /etc/e-smith/templates-custom/etc/sysconfig/slapd
nano /etc/e-smith/templates-custom/etc/sysconfig/slapd/40OPTIONS

{
{
# Any custom options
#SLAPD_OPTIONS=" -4 -d { $ldap{LogLevel} || 256 } -s 0 "
my $slapdOptions = "#Test";
my $logLevel = $ldap{LogLevel} || 256;
if ($IPv6{'status'} eq "enabled") {
    $slapdOptions = "SLAPD_OPTIONS=\"-d  $logLevel -s 0\" " ;
    } else {
    $slapdOptions = "SLAPD_OPTIONS=\"-4 -d $logLevel -s 0\" " ;
}
$OUT .= "# Any custom options\n";
$OUT .= "$slapdOptions\n";
}

#Environment="SLAPD_URLS=ldap:/// ldaps:/// ldapi:///" "SLAPD_OPTIONS=-4 -d 256 -s 0"
EnvironmentFile=/etc/sysconfig/slapd

systemctl daemon-reload
systemctl restart ldap.service

/etc/cpu-system.conf

[LDAP]
LDAP_HOST       = 127.0.0.1
LDAP_PORT       = 389

https://[2001:470:1f13:3ff:2a9:b700:fe99:792c]

ping6 2001:470:1f13:3ff:2a9:b700:fe99:792c

@@ Line 166: / Line 166: @@
 ====Services====
-List of other affected services
+List of other affected services and vague efforts to get IPv6 running for them.
 httpd
@@ Line 182: / Line 182: @@
 ldap as below
-SSH (bad hack here so careful as this may open your server up to remote access)
+=====SSH===== (bad hack here so careful as this may open your server up to remote access)
   mkdir /etc/e-smith/templates-custom/etc/ssh/sshd_config
@@ Line 206: / Line 206: @@
   ssh root@2001:470:1f13:3ff:2a9:b700:fe99:792c
-LDAP
+=====LDAP=====
   mkdir -p /etc/e-smith/templates-custom/etc/sysconfig/slapd
@@ Line 235: / Line 235: @@
   systemctl daemon-reload
   systemctl restart ldap.service
+'''However, /usr/sbin/cpu is not IPv6 aware and is unmaintained.'''
+We can bypass this and force IPv4 by editing:
+ /etc/cpu-system.conf
+Modify the template and change localhost to 127.0.0.1
+ [LDAP]
+ LDAP_HOST       = 127.0.0.1
+ LDAP_PORT       = 389
 ===Other notes===

Difference between revisions of "IPv6"

Latest revision as of 14:09, 1 February 2023

Contents

IPv6 implementation on Koozali SME Server

Commentary

List of areas to be considered

Config entries

IP addresses

Enable networking

Firewall

Server/Gateway

DNS/DHCPD

Services

LDAP

Other notes

Bugs

Navigation menu

Search

	Warning:
	Code below is highly experimental. Do NOT try it on a production server.

	Warning:
	Code below is highly experimental. TESTING ONLY. Do NOT try it on a production server as you will almost certainly get hacked

	Warning:
	If you run the following command your server will have a public IP and NO firewall. You have been warned