enable ipv6 globally (#450)

Signed-off-by: Sebastian Gumprich <[email protected]>

roles/os_hardening/README.md

@@ -172,6 +172,9 @@ We know that this is the case on Raspberry Pi.
 - `ufw_default_forward_policy`
   - Default: `DROP`
   - Description: set default forward policy of ufw to `DROP`.
+- `ufw_enable_ipv6`
+  - Default: `true`
+  - Description: Set to `true` to apply rules to support IPv6 (no means only IPv6 on loopback accepted).
 - `os_auditd_enabled`
   - Default: `true`
   - Description: Set to false to disable installing and configuring auditd.

roles/os_hardening/defaults/main.yml

@@ -58,6 +58,10 @@ ufw_default_application_policy: 'SKIP'
 ufw_manage_builtins: 'no'
 ufw_ipt_modules: 'nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns'
 
+# Set to true to apply rules to support IPv6 (no means only IPv6 on loopback
+# accepted).
+ufw_enable_ipv6: true
+
 sysctl_config:
   # These settings eliminate an entire class of security vulnerabilities:
   # time-of-check-time-of-use cross-privilege attacks using guessable

roles/os_hardening/templates/etc/default/ufw.j2

@@ -7,7 +7,7 @@
 # Set to yes to apply rules to support IPv6 (no means only IPv6 on loopback
 # accepted). You will need to 'disable' and then 'enable' the firewall for
 # the changes to take affect.
-IPV6={{ 'no' if sysctl_config['net.ipv6.conf.all.disable_ipv6'] is defined and sysctl_config['net.ipv6.conf.all.disable_ipv6'] == 1 else 'yes' }}
+IPV6={{ 'yes' if ufw_enable_ipv6 else 'no' }}
 
 # Set the default input policy to ACCEPT, DROP, or REJECT. Please note that if
 # you change this you will most likely want to adjust your rules.

roles/ssh_hardening/README.md

@@ -15,8 +15,8 @@ Warning: This role disables root-login on the target server! Please make sure yo
 ## Role Variables
 
 - `network_ipv6_enable`
-  - Default: `false`
-  - Description: true if IPv6 is needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
+  - Default: `true`
+  - Description: false if IPv6 is not needed. `ssh_listen_to` must also be set to listen to IPv6 addresses (for example `[::]`).
 - `ssh_client_config_file`
   - Default: `'/etc/ssh/ssh_config'`
   - Description: path of the ssh client configuration file, e.g. `/etc/ssh/ssh_config.d/custom.conf`.

roles/ssh_hardening/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 # true if IPv6 is needed
-network_ipv6_enable: false          # sshd + ssh
+network_ipv6_enable: true          # sshd + ssh
 
 # Paths of the config files
 ssh_client_config_file: /etc/ssh/ssh_config   # ssh