mrcharles
d75366edf5
deploy-agent.sh now self-heals the three postinst failure modes found on PMG/PBS hosts (MANAGER_IP placeholder, missing wazuh user, root:root ownership). scripts/disable-ipv6.sh: live sysctl + persisted conf, with in-file rollback notes. Rollout state in #335/#748. Meat: https://projects.knownelement.com/issues/335#note-4008
31 lines
1.2 KiB
Bash
31 lines
1.2 KiB
Bash
#!/bin/bash
|
|
#
|
|
# disable-ipv6.sh — kill IPv6 live + persist (no reboot) [#748]
|
|
# Run as root. Idempotent. Charles ruling 2026-09-03: IPv6 off fleet-wide.
|
|
# Rollback per host: delete /etc/sysctl.d/99-disable-ipv6.conf, then
|
|
# sysctl -w net.ipv6.conf.all.disable_ipv6=0 (and per-interface =0 as needed).
|
|
#
|
|
set -euo pipefail
|
|
|
|
CONF=/etc/sysctl.d/99-disable-ipv6.conf
|
|
cat > "$CONF" <<'EOF'
|
|
# IPv6 disabled fleet-wide (Charles ruling 2026-09-03, [#748], follow-on to [#745])
|
|
# Rollback: delete this file, then set net.ipv6.conf.{all,default,lo}.disable_ipv6=0
|
|
net.ipv6.conf.all.disable_ipv6 = 1
|
|
net.ipv6.conf.default.disable_ipv6 = 1
|
|
net.ipv6.conf.lo.disable_ipv6 = 1
|
|
EOF
|
|
|
|
# Live apply: 'all' gates new traffic; per-interface flags disable existing ifs
|
|
# (incl. lo, tailscale0, docker0 — fleet-wide consistent, v4 everywhere).
|
|
sysctl -q -w net.ipv6.conf.all.disable_ipv6=1
|
|
sysctl -q -w net.ipv6.conf.default.disable_ipv6=1
|
|
sysctl -q -w net.ipv6.conf.lo.disable_ipv6=1
|
|
for f in /proc/sys/net/ipv6/conf/*/disable_ipv6; do
|
|
echo 1 > "$f" 2>/dev/null || true
|
|
done
|
|
|
|
v=$(sysctl -n net.ipv6.conf.all.disable_ipv6)
|
|
n=$(ip -6 addr show 2>/dev/null | grep -c inet6 || true)
|
|
echo "host=$(hostname) ipv6_disabled=$v remaining_inet6_addrs=$n"
|