KNEL/PFVCluster
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(siem): agent fixes from fleet pass; IPv6 kill script [#335][#748]

Browse Source 
deploy-agent.sh now self-heals the three postinst failure modes found on
PMG/PBS hosts (MANAGER_IP placeholder, missing wazuh user, root:root
ownership). scripts/disable-ipv6.sh: live sysctl + persisted conf, with
in-file rollback notes. Rollout state in #335/#748.
Meat: https://projects.knownelement.com/issues/335#note-4008
This commit is contained in:
mrcharles
2026-09-03 07:13:28 -05:00
parent 2485866ccd
commit d75366edf5
2 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/disable-ipv6.sh
+30
View File
@@ -0,0 +1,30 @@
#!/bin/bash
#
# disable-ipv6.sh — kill IPv6 live + persist (no reboot) [#748]
# Run as root. Idempotent. Charles ruling 2026-09-03: IPv6 off fleet-wide.
# Rollback per host: delete /etc/sysctl.d/99-disable-ipv6.conf, then
# sysctl -w net.ipv6.conf.all.disable_ipv6=0 (and per-interface =0 as needed).
#
set -euo pipefail
CONF=/etc/sysctl.d/99-disable-ipv6.conf
cat > "$CONF" <<'EOF'
# IPv6 disabled fleet-wide (Charles ruling 2026-09-03, [#748], follow-on to [#745])
# Rollback: delete this file, then set net.ipv6.conf.{all,default,lo}.disable_ipv6=0
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
EOF
# Live apply: 'all' gates new traffic; per-interface flags disable existing ifs
# (incl. lo, tailscale0, docker0 — fleet-wide consistent, v4 everywhere).
sysctl -q -w net.ipv6.conf.all.disable_ipv6=1
sysctl -q -w net.ipv6.conf.default.disable_ipv6=1
sysctl -q -w net.ipv6.conf.lo.disable_ipv6=1
for f in /proc/sys/net/ipv6/conf/*/disable_ipv6; do
echo 1 > "$f" 2>/dev/null || true
done
v=$(sysctl -n net.ipv6.conf.all.disable_ipv6)
n=$(ip -6 addr show 2>/dev/null | grep -c inet6 || true)
echo "host=$(hostname) ipv6_disabled=$v remaining_inet6_addrs=$n"