Views:

Perform the following steps to disable IPv6 in the Trend Micro Smart Protection Server using the command line.

For SPS 3.0

Modify the value of following parameter:
-bash-3.2# vi /etc/modprobe.conf
alias net-pf-10 off
Modify the value of following parameter:
-bash-3.2# vi /etc/sysconfig/network
NETWORKING_IPV6=no
Execute the following commands:
-bash-3.2# /etc/init.d/ip6tables stop
-bash-3.2# chkconfig --level 2345 ip6tables off
-bash-3.2# modprobe -r -v ip6_tables
Edit the value of following parameter:
-bash-3.2# vi /etc/snmp/snmpd.conf
agentaddress udp:161
Comment the following sentences:
-bash-3.2# vi /var/tmcss/cpmpatch/svaiptables
# FW6_SYS = "/etc/init.d/ip6tables "
# os.system("/sbin/ip6tables -F")

# os.system("/sbin/ip6tables -X")
# os.system("/sbin/ip6tables -Z")
# os.system("iptables-save | grep -v icmp |grep -v
SNMP_SERV_IN |grep -v CPM_SERV_IN |ip6tables-restore")
# os.system("ip6tables -A LOCAL_SERV_IN -p icmpv6 -j ACCEPT")

# os.system(SVAFirewall.FW6_SYS + "start")
# os.system(SVAFirewall.FW6_SYS + "stop")

# os.system("ip6tables -A INPUT -p tcp --tcp-flags ALL SYN,ACK -j ACCEPT")
# os.system("ip6tables -A INPUT -p tcp --tcp-flags ALL ACK -j ACCEPT")
# os.system("ip6tables -A INPUT -p tcp --tcp-flags ALL PSH,ACK -j ACCEPT")
# os.system("ip6tables -A INPUT -p tcp --tcp-flags ALL FIN,ACK -j ACCEPT")
# os.system("ip6tables -A INPUT -p tcp --tcp-flags ALL PSH,FIN,ACK -j ACCEPT")

# os.system("/sbin/ip6tables -A LOCAL_SERV_IN -p tcp --dport " + self.ssh_port + " -j ACCEPT")
# os.system("/sbin/ip6tables -I LOCAL_SERV_IN -p icmpv6 --icmpv6-type echo-request -j DROP > /dev/null 2>&1");
# os.system("/sbin/ip6tables -A LOCAL_SERV_IN -p tcp --dport " + iwsva.port_service + " -j ACCEPT")
# os.system("/sbin/ip6tables -A LOCAL_SERV_IN -p tcp --dport " + self.frs_http_port + " -j ACCEPT")
# os.system("/sbin/ip6tables -A LOCAL_SERV_IN -p tcp --dport " + self.frs_https_port + " -j ACCEPT")
# os.system("/sbin/ip6tables -A LOCAL_SERV_IN -p tcp --dport 546 -j ACCEPT")
# os.system("/sbin/ip6tables -A LOCAL_SERV_IN -p udp --dport 546 -j ACCEPT")
# os.system("/sbin/ip6tables -D SERV_GATE -p tcp --dport " + self.wrs_http_port + " -j DROP > /dev/null 2>&1");
# os.system("/sbin/ip6tables -A SERV_GATE -p tcp --dport " + self.wrs_http_port + " -j DROP");

-bash-3.2# cp /var/tmcss/cpmpatch/svaiptables /etc/init.d/svaiptables
Comments the following sentences:
-bash-3.2# vi /etc/lighttpd/lighttpd.conf
# listen to ipv6
#$SERVER["socket"] == "[::]:" + var.frs-http-port {
# $HTTP["host"] =~ "^(.*)$" {
# url.redirect = ( "^/$" => "https://%1:4343/",
# "^/tmcss/$" => "http://%1/$1")
# }
#}

#$SERVER["socket"] == "[::]:4343" {
#ssl.engine = "enable"
#ssl.pemfile = "/etc/lighttpd/server.pem"
#ssl.cipher-list = ssl-cipher-list
#accesslog.filename = "/var/log/lighttpd/mgt_access.log"
#server.document-root = var.AdminUI.document-root
#fastcgi.server = ( ".php" =>
# ( "localhost" =>
# (
# "socket" => "/tmp/php-fastcgi.socket",
# "bin-path" => "/usr/bin/php-cgi",
# "max-procs" => 4,
# "bin-environment" =>
# (
# "PHP_FCGI_CHILDREN" => "8",
# "PHP_FCGI_MAX_REQUESTS" => "1000"
# )
# )
# )
# )
#}

#Setting for LWCS
#$SERVER["socket"] == "[::]:" + var.wrs-http-port {
#server.document-root = "/var/www/iCRC/tmcss/"
#accesslog.filename = "/var/log/lighttpd/lwcs_access.log"
#server.indexfiles = ("lwcsfcgi")
#server.error-handler-404 = "/lwcsfcgi"
#fastcgi.server = ( "" =>
# ( "" =>
# (
# "socket" => "/tmp/lwcsfcgi-fastcgi.socket",
# "bin-path" => "/var/www/iCRC/tmcss/lwcsfcgi",
# "max-procs" => 90,
# "idle-timeout" => 30
# )
# )
# )
#}

#$SERVER["socket"] == "[::]:" + var.frs-https-port {
#ssl.engine = "enable"
#ssl.pemfile = "/etc/lighttpd/server.pem"
#ssl.cipher-list = ssl-cipher-list
# $HTTP["host"] =~ "^(.*)$" {
# url.redirect = ( "^/$" => "https://%1:4343/",
# "^/tmcss/$" => "https://%1/$1")
# }
#}
Comment the following sentences:
-bash-3.2# vi /usr/tmcss/bin/snmp_set.sh
#IP6TABLES='/sbin/ip6tables'
# $IP6TABLES -F $SNMP_CHAIN 2> /dev/null
# $IP6TABLES -D INPUT -j $SNMP_CHAIN 2> /dev/null
# $IP6TABLES -X $SNMP_CHAIN 2> /dev/null

# $IP6TABLES -N $SNMP_CHAIN
# $IP6TABLES -A INPUT -j $SNMP_CHAIN
# $IP6TABLES -A $SNMP_CHAIN -p udp --dport $SNMP_PORT -s $1/$2 -j ACCEPT
# $IP6TABLES -A $SNMP_CHAIN -p udp --dport $SNMP_PORT -s $1/$2 -j ACCEPT
Comment the following sentences:
-bash-3.2# vi /usr/tmcss/bin/patchcpm_set.sh
#IP6TABLES='/sbin/ip6tables'

# $IP6TABLES -F $CPM_CHAIN > /dev/null 2>&1
# $IP6TABLES -D INPUT -j $CPM_CHAIN > /dev/null 2>&1
# $IP6TABLES -X $CPM_CHAIN > /dev/null 2>&1

# $IP6TABLES -N $CPM_CHAIN
# $IP6TABLES -A INPUT -j $CPM_CHAIN

# $IP6TABLES -A $CPM_CHAIN -p tcp --dport $1 -j ACCEPT
# $IP6TABLES -A $CPM_CHAIN -p udp --dport $1 -j ACCEPT
Comment the following sentences:
-bash-3.2# vi /usr/tmcss/bin/CollectSystemInfo.sh
# echo -e "\n[ip6table] (Run Command \"ip6tables -L\")" >> $target_file_location/$target_file_name

# echo "`date` [$Module_Name] > ip6tables -L" | tee -a $CDT_LOG_FILE_NAME | more
# ip6tables -L >> $target_file_location/$target_file_name 2>>$CDT_LOG_FILE_NAME
Comment and modify the following sentences:
-bash-3.2# vi /usr/tmcss/bin/tlogger
#cmdip6tables = "/sbin/ip6tables"

tin = long(getTraffic(cmdiptables, "WCS_SERV_IN")) + long(getTraffic(cmdip6tables, "WCS_SERV_IN"))
tout= long(getTraffic(cmdiptables, "WCS_SERV_OUT")) + long(getTraffic(cmdip6tables, "WCS_SERV_OUT"))
--->>>
tin = long(getTraffic(cmdiptables, "WCS_SERV_IN"))
tout= long(getTraffic(cmdiptables, "WCS_SERV_OUT"))
Reboot the SPS.

For SPS 2.5

Log in to the Trend Smart Protection Server server using SSH connection using root account.
Execute the following commands to disable IPv6:
# service ip6tables stop
# chkconfig ip6tables off
Comment out all IPv6-related settings in /etc/lighttpd/lighttpd.conf with the following:
1. Execute the command:
  # vi /etc/lighttpd/lighttpd.conf
2. Press INSERT key to enter Edit mode.
3. Uncomment line 153 and change it to:
  server.use-ipv6 = "disable"
Comment all IPv6 configurations on these lines:
lines 157 through 163
lines 290 through 309
lines 330 through 346
lines 370 through 377
Press the ESC key then press ":wq!"" to save and close the file.
Comment out all IPv6-related settings in the /etc/snmp/snmpd.conf.
1. Execute the following command:
  # vi /etc/snmp/snmpd.conf
2. Press the INSERT key to enter Edit mode.
3. Change line 465 from "agentaddress udp:161,udp6:161" to:
  agentaddress udp:161
4. Press the ESC key, then press ":wq!"" to save and close the file.
Change the value of NETWORKING_IPV6 inside the /etc/sysconfig/network file.
1. Execute the following command:
  # vi /etc/sysconfig/network
2. Press the INSERT key to enter Edit mode.
3. Set NETWORKING_IPV6=no.
4. Press the ESC key, then press ":wq!"" to save and close the file.
Run the following commands to restart the lighttpd and snmpd daemons to apply the new settings.
# service lighttpd restart
# service snmpd restart

Keywords: IPv6,Smart Protection Server,SPS,Smart Scan Server,disable IPv6

Deactivating IPv6 in Smart Protection Server (SPS)

Product / Version includes:

Smart Protection Server3.0

Last updated: 2021/08/28

Solution ID: KA-0002778

Category: Configure , Deploy , Install , Uninstall

Summary

IPv6 is enabled starting on the stand-alone Smart Protection Server (SPS) 2.5 by default. However, IPv6 does not work properly in certain network environments and there are also company policies that prohibit running IPv6. These situations require administrators to disable IPv6 from SPS 2.5 or 3.0.

Perform the following steps to disable IPv6 in the Trend Micro Smart Protection Server using the command line.

EXPAND ALL

For SPS 3.0

Modify the value of following parameter:
-bash-3.2# vi /etc/modprobe.conf
alias net-pf-10 off
Modify the value of following parameter:
-bash-3.2# vi /etc/sysconfig/network
NETWORKING_IPV6=no
Execute the following commands:
-bash-3.2# /etc/init.d/ip6tables stop
-bash-3.2# chkconfig --level 2345 ip6tables off
-bash-3.2# modprobe -r -v ip6_tables
Edit the value of following parameter:
-bash-3.2# vi /etc/snmp/snmpd.conf
agentaddress udp:161
Comment the following sentences:
-bash-3.2# vi /var/tmcss/cpmpatch/svaiptables
# FW6_SYS = "/etc/init.d/ip6tables "
# os.system("/sbin/ip6tables -F")

# os.system("/sbin/ip6tables -X")
# os.system("/sbin/ip6tables -Z")
# os.system("iptables-save | grep -v icmp |grep -v
SNMP_SERV_IN |grep -v CPM_SERV_IN |ip6tables-restore")
# os.system("ip6tables -A LOCAL_SERV_IN -p icmpv6 -j ACCEPT")

# os.system(SVAFirewall.FW6_SYS + "start")
# os.system(SVAFirewall.FW6_SYS + "stop")

# os.system("ip6tables -A INPUT -p tcp --tcp-flags ALL SYN,ACK -j ACCEPT")
# os.system("ip6tables -A INPUT -p tcp --tcp-flags ALL ACK -j ACCEPT")
# os.system("ip6tables -A INPUT -p tcp --tcp-flags ALL PSH,ACK -j ACCEPT")
# os.system("ip6tables -A INPUT -p tcp --tcp-flags ALL FIN,ACK -j ACCEPT")
# os.system("ip6tables -A INPUT -p tcp --tcp-flags ALL PSH,FIN,ACK -j ACCEPT")

# os.system("/sbin/ip6tables -A LOCAL_SERV_IN -p tcp --dport " + self.ssh_port + " -j ACCEPT")
# os.system("/sbin/ip6tables -I LOCAL_SERV_IN -p icmpv6 --icmpv6-type echo-request -j DROP > /dev/null 2>&1");
# os.system("/sbin/ip6tables -A LOCAL_SERV_IN -p tcp --dport " + iwsva.port_service + " -j ACCEPT")
# os.system("/sbin/ip6tables -A LOCAL_SERV_IN -p tcp --dport " + self.frs_http_port + " -j ACCEPT")
# os.system("/sbin/ip6tables -A LOCAL_SERV_IN -p tcp --dport " + self.frs_https_port + " -j ACCEPT")
# os.system("/sbin/ip6tables -A LOCAL_SERV_IN -p tcp --dport 546 -j ACCEPT")
# os.system("/sbin/ip6tables -A LOCAL_SERV_IN -p udp --dport 546 -j ACCEPT")
# os.system("/sbin/ip6tables -D SERV_GATE -p tcp --dport " + self.wrs_http_port + " -j DROP > /dev/null 2>&1");
# os.system("/sbin/ip6tables -A SERV_GATE -p tcp --dport " + self.wrs_http_port + " -j DROP");

-bash-3.2# cp /var/tmcss/cpmpatch/svaiptables /etc/init.d/svaiptables
Comments the following sentences:
-bash-3.2# vi /etc/lighttpd/lighttpd.conf
# listen to ipv6
#$SERVER["socket"] == "[::]:" + var.frs-http-port {
# $HTTP["host"] =~ "^(.*)$" {
# url.redirect = ( "^/$" => "https://%1:4343/",
# "^/tmcss/$" => "http://%1/$1")
# }
#}

#$SERVER["socket"] == "[::]:4343" {
#ssl.engine = "enable"
#ssl.pemfile = "/etc/lighttpd/server.pem"
#ssl.cipher-list = ssl-cipher-list
#accesslog.filename = "/var/log/lighttpd/mgt_access.log"
#server.document-root = var.AdminUI.document-root
#fastcgi.server = ( ".php" =>
# ( "localhost" =>
# (
# "socket" => "/tmp/php-fastcgi.socket",
# "bin-path" => "/usr/bin/php-cgi",
# "max-procs" => 4,
# "bin-environment" =>
# (
# "PHP_FCGI_CHILDREN" => "8",
# "PHP_FCGI_MAX_REQUESTS" => "1000"
# )
# )
# )
# )
#}

#Setting for LWCS
#$SERVER["socket"] == "[::]:" + var.wrs-http-port {
#server.document-root = "/var/www/iCRC/tmcss/"
#accesslog.filename = "/var/log/lighttpd/lwcs_access.log"
#server.indexfiles = ("lwcsfcgi")
#server.error-handler-404 = "/lwcsfcgi"
#fastcgi.server = ( "" =>
# ( "" =>
# (
# "socket" => "/tmp/lwcsfcgi-fastcgi.socket",
# "bin-path" => "/var/www/iCRC/tmcss/lwcsfcgi",
# "max-procs" => 90,
# "idle-timeout" => 30
# )
# )
# )
#}

#$SERVER["socket"] == "[::]:" + var.frs-https-port {
#ssl.engine = "enable"
#ssl.pemfile = "/etc/lighttpd/server.pem"
#ssl.cipher-list = ssl-cipher-list
# $HTTP["host"] =~ "^(.*)$" {
# url.redirect = ( "^/$" => "https://%1:4343/",
# "^/tmcss/$" => "https://%1/$1")
# }
#}
Comment the following sentences:
-bash-3.2# vi /usr/tmcss/bin/snmp_set.sh
#IP6TABLES='/sbin/ip6tables'
# $IP6TABLES -F $SNMP_CHAIN 2> /dev/null
# $IP6TABLES -D INPUT -j $SNMP_CHAIN 2> /dev/null
# $IP6TABLES -X $SNMP_CHAIN 2> /dev/null

# $IP6TABLES -N $SNMP_CHAIN
# $IP6TABLES -A INPUT -j $SNMP_CHAIN
# $IP6TABLES -A $SNMP_CHAIN -p udp --dport $SNMP_PORT -s $1/$2 -j ACCEPT
# $IP6TABLES -A $SNMP_CHAIN -p udp --dport $SNMP_PORT -s $1/$2 -j ACCEPT
Comment the following sentences:
-bash-3.2# vi /usr/tmcss/bin/patchcpm_set.sh
#IP6TABLES='/sbin/ip6tables'

# $IP6TABLES -F $CPM_CHAIN > /dev/null 2>&1
# $IP6TABLES -D INPUT -j $CPM_CHAIN > /dev/null 2>&1
# $IP6TABLES -X $CPM_CHAIN > /dev/null 2>&1

# $IP6TABLES -N $CPM_CHAIN
# $IP6TABLES -A INPUT -j $CPM_CHAIN

# $IP6TABLES -A $CPM_CHAIN -p tcp --dport $1 -j ACCEPT
# $IP6TABLES -A $CPM_CHAIN -p udp --dport $1 -j ACCEPT
Comment the following sentences:
-bash-3.2# vi /usr/tmcss/bin/CollectSystemInfo.sh
# echo -e "\n[ip6table] (Run Command \"ip6tables -L\")" >> $target_file_location/$target_file_name

# echo "`date` [$Module_Name] > ip6tables -L" | tee -a $CDT_LOG_FILE_NAME | more
# ip6tables -L >> $target_file_location/$target_file_name 2>>$CDT_LOG_FILE_NAME
Comment and modify the following sentences:
-bash-3.2# vi /usr/tmcss/bin/tlogger
#cmdip6tables = "/sbin/ip6tables"

tin = long(getTraffic(cmdiptables, "WCS_SERV_IN")) + long(getTraffic(cmdip6tables, "WCS_SERV_IN"))
tout= long(getTraffic(cmdiptables, "WCS_SERV_OUT")) + long(getTraffic(cmdip6tables, "WCS_SERV_OUT"))
--->>>
tin = long(getTraffic(cmdiptables, "WCS_SERV_IN"))
tout= long(getTraffic(cmdiptables, "WCS_SERV_OUT"))
Reboot the SPS.

For SPS 2.5

Log in to the Trend Smart Protection Server server using SSH connection using root account.
Execute the following commands to disable IPv6:
# service ip6tables stop
# chkconfig ip6tables off
Comment out all IPv6-related settings in /etc/lighttpd/lighttpd.conf with the following:
1. Execute the command:
  # vi /etc/lighttpd/lighttpd.conf
2. Press INSERT key to enter Edit mode.
3. Uncomment line 153 and change it to:
  server.use-ipv6 = "disable"
Comment all IPv6 configurations on these lines:
lines 157 through 163
lines 290 through 309
lines 330 through 346
lines 370 through 377
Press the ESC key then press ":wq!"" to save and close the file.
Comment out all IPv6-related settings in the /etc/snmp/snmpd.conf.
1. Execute the following command:
  # vi /etc/snmp/snmpd.conf
2. Press the INSERT key to enter Edit mode.
3. Change line 465 from "agentaddress udp:161,udp6:161" to:
  agentaddress udp:161
4. Press the ESC key, then press ":wq!"" to save and close the file.
Change the value of NETWORKING_IPV6 inside the /etc/sysconfig/network file.
1. Execute the following command:
  # vi /etc/sysconfig/network
2. Press the INSERT key to enter Edit mode.
3. Set NETWORKING_IPV6=no.
4. Press the ESC key, then press ":wq!"" to save and close the file.
Run the following commands to restart the lighttpd and snmpd daemons to apply the new settings.
# service lighttpd restart
# service snmpd restart

Was this article helpful?

Featured

Automation Center

Education Portal

Online Help Center

Service Status

TrendConnect

Deactivating IPv6 in Smart Protection Server (SPS)

For SPS 3.0

For SPS 2.5

Deactivating IPv6 in Smart Protection Server (SPS)

Product / Version includes:

Summary

For SPS 3.0

For SPS 2.5