Chef client failing on OS restart with Amazon Linux about chef-os-hardening HOT 4 CLOSED

@phanikumar1210 Thanks for raising this issue! Unfortunately I can't reproduce it with test-kitchen and vagrant in this repo, I tried:

1. kitchen verify default-amazonlinux-1
2. kitchen login
3. sudo reboot
4. wait a bit
5. kitchen converge default-amazonlinux-1

Could you maybe check if you have something, what prevents loading of ipv6 kernel module?
E.g. you can try this:

grep -i ipv6 /etc/modprobe.d/*

if you get something like:

/etc/modprobe.d/disable-ipv6.conf:install ipv6 /bin/true

this would be the reason. The ipv6 module loading is prevented and its not loaded when the system starts, so the configuration namespace net.ipv6 isn't available in the kernel

from chef-os-hardening.

I am getting following response for grep -i ipv6 /etc/modprobe.d/*

/etc/modprobe.d/CIS.conf:options ipv6 disable=1

from chef-os-hardening.

Removing options ipv6 disable=1 option from /etc/modprobe.d/CIS.conf resolved the issue.

from chef-os-hardening.

Yeah, we also handle this requirement, but differently. The official recommended way is not to blacklist the IPv6 module (as it leads to different problems), but to use net.ipv6.conf.all.disable_ipv6 for that. I can't find the link anymore, but I remember this was some recommendation from RH and this option was introduced exactly to avoid the module blacklisting.

I'm closing this issue as it looks like the problem is resolved and not related to chef-os-hardening.

from chef-os-hardening.