• Welcome to Hurricane Electric's IPv6 Tunnel Broker Forums.

News:

Welcome to Hurricane Electric's Tunnelbroker.net forums!

Main Menu

Software configs

Started by broquea, November 20, 2008, 10:46:16 PM

Previous topic - Next topic

broquea

So by default, at least on the more recent versions of Fedora, CentOS, Ubuntu and FreeBSD that I've configured, most services seem ready out of the box for IPv6, mostly in a dual-stack default way.

OpenSSH: sshd_config
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

Should already be set, which makes it listen on any address configured, IPv4 or IPv6. So if you only want it available on 1 IP, set it there.

Postfix: main.cf
inet_interfaces = all
inet_protocols = all

Since I run dual-stack, the second line makes it use both IPv4 & IPv6. First line I have that way by default, but would make sense if you've terminated a tunnel on your mail server and need that interface included.

Apache: httpd.conf
Listen 80
This again has been dual-stack happy since by default it is configured to just listen on port 80 regardless of the IP. You can of course do the whole virtual-hosting, and configure like:
<VirtualHost x.x.x.x:80 [A:B:C:D::F]:80>
Where x.x.x.x is your IPv4 address and A:B:C:D::F your IPv6.

Dovecot: dovecot.conf
listen = [*]
listen = [::]

Again I run dual-stack so I want both configured. You can always lock it down to single IPs.


If anyone has more examples, please share!

kriteknetworks

#1

<bind-address>::</bind-address>


will listen on all ipv4/6 interfaces by default
Optionally specific addresses can be assigned, ipv4/6

kriteknetworks

#2
in your sendmail.mc (or $HOSTNAME.mc fbsd 7.x) put the following:


dnl Enable for both IPv4 and IPv6 (optional)
DAEMON_OPTIONS(`Name=IPv4, Family=inet, Addr=xxx.xxx.xxx.xxx')dnl
DAEMON_OPTIONS(`Name=IPv6, Family=inet6, Addr=200x:xxxx:xxxx:xxxx::xxxx')dnl


rebuild sendmail.cf, backup old sendmail.cf, cp new one over, restart sendmail, lsof -itcp:25 or netstat to confirm listening on specified IPs.

NOTE: slackware linux does not enable ipv6 in sendmail, requires building from scratch. I have no experience with sendmail on other linux distros, so I don't know what support they ship sendmail with.

broquea

#3
BIND(9):

Here are some examples from working in-production personal stuff. These are just how I've always configured my zones from some ancient bind zone-file generating script long lost and not forgotten.

named.conf; reverse zone for /64:
zone "9.0.0.0.1.0.0.0.0.7.4.0.1.0.0.2.ip6.arpa" {
type master;
file "/etc/bind/reverse-2001-470-1-9_64.IP6.ARPA";
allow-transfer {
};
};


reverse-2001-470-1-9_64.IP6.ARPA:
$TTL 300
@ IN SOA 9.0.0.0.1.0.0.0.0.7.4.0.1.0.0.2.ip6.arpa. broquea.deus-exmachina.net. (
200810210 ; Serial number (YYYYMMdd)
24h ; Refresh time
30m ; Retry time
2d ; Expire time
3d ; Default TTL (bind 8 ignores this, bind 9 needs it)
)

                                ; Name server entries
                                IN     NS     ns1.deus-exmachina.net.
; IPv6 PTR entries

; Subnet #1
$ORIGIN 9.0.0.0.1.0.0.0.0.7.4.0.1.0.0.2.ip6.arpa.

a.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0         IN      PTR     master.deus-exmachina.net.
b.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0         IN      PTR     deus-exmachina.net.
c.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0         IN      PTR     ns1.deus-exmachina.net.
6.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0         IN      PTR     onion-cafe.com.


Zonefile for one of my domains, showing AAAA examples:
$TTL 300
onion-cafe.com. IN    SOA   ns1.deus-exmachina.net. broquea.deus-exmachina.net. (
                  200810220   ;serial
                  8H       ;refresh
                  2H         ;retry
                  1W         ;expire
                  1D )

IN NS ns1.deus-exmachina.net.
IN NS ns2.deus-exmachina.net.
IN MX 1 mail.onion-cafe.com.
IN A 72.52.116.26
IN AAAA    2001:470:1:9::26
mail IN A 72.52.116.26
IN AAAA 2001:470:1:9::26
www IN A 72.52.116.26
IN AAAA 2001:470:1:9::26


This is not the secret message.

ericj

/etc/proftpd/proftpd.conf
UseIPv6 on
(usually set by default)

ericj

/etc/ircd-hybrid/ircd.conflisten {
        host = "0.0.0.0"; # Bind to all IPv4
        host = "::"; # Bind to all IPv6
        port = 6665 .. 6669; # Use Ports 6665 to 6669
};


carrerasg

This enables privacy extensions on ubuntu (8.10), maybe some others too.
Add to the bottom of /etc/sysctl.conf (note the reference to the interface in the second statement)

# Fix to create temporary addresses (privacy extensions)
net.ipv6.conf.eth0.use_tempaddr=2
net.ipv6.conf.all.use_tempaddr=2
net.ipv6.conf.default.use_tempaddr=2

wamble

Quote from: broquea on November 20, 2008, 10:46:16 PM
Dovecot: dovecot.conf
listen = [*]
listen = [::]


I tried this and couldn't get it to work. Looking at http://wiki.dovecot.org/MainConfig it tells me to use both one line:

listen=*,[::]

allen4names

Hiawatha does not bind to IPv6 addresses by default.

Binding {
    Interface = ::1
    Port = 80
}


Whereas you do not need to bind an interface for IPv4.

Binding {
    Port = 80
}


The author welcomes bug reports.

Hugo Leisink <hugo@hiawatha-webserver.org> - http://www.hiawatha-webserver.org/

Allen4names

s3n

#9
To make ejabberd listen on ipv4 and ipv6 interfaces add inet6 option.
...
{listen,
 [
   {5222, ejabberd_c2s, [
     inet6,
     {access, c2s},
     {shaper, c2s_shaper},
     ...


For nginx (also dual-stack configuration):
server {
    listen [::]:80;
    ...

DOMBlogger

Note on the Apache config - since IPv6 addresses are readily available, I'm doing virtual hosts a wee bit differently.
Example domain.net.conf in my /etc/httpd/conf.d directory:


NameVirtualHost [2600:3c00::xx:yyyy]:80

<VirtualHost nnn.nnn.nnn.nnn:80>
ServerName www.domain.tld
DocumentRoot "/srv/domains/domain.tld/www"
ErrorLog logs/www.domain.tld.error_log
CustomLog logs/www.domain.tld.access_log combined
</VirtualHost>

<VirtualHost [2600:3c00::xx:yyyy]:80>
ServerName www.domain.tld
DocumentRoot "/srv/domains/domain.tld/www"
ErrorLog logs/www.domain.tld.error_log
CustomLog logs/www.domain.tld.access_log combined
</VirtualHost>

<VirtualHost nnn.nnn.nnn.nnn:80>
ServerName domain.tld
RewriteEngine On
RewriteRule ^(.*)$ http://www.domain.tld$1 [R]
</VirtualHost>

<VirtualHost [2600:3c00::xx:yyyy]:80>
ServerName domain.tld
RewriteEngine On
RewriteRule ^(.*)$ http://www.domain.tld$1 [R]
</VirtualHost>

<Directory "/srv/domains/domain.tld/www">
  Options FollowSymLinks
  AllowOverride All
</Directory>

<Directory "/srv/domains/domain.tld/www/junk">
  Options FollowSymLinks Indexes
  AllowOverride All
</Directory>


I probably could (and should) combine the top two into 1 and bottom two into 1.

IPv4 address is used for several domains.
IPv6 is used only for the specific domain.tld and www.domain.tld - which is why the domain specific conf file is where the NameVirtualHost for the IPv6 goes (and is actually only needed for the mod_rewrite when the non www domain is requested)

Using a unique IP for each domain.tld in IPv6 lets me use that same unique IPv6 for each domain on port 443.

I know most if not every browser that supports IPv6 also supports NSI but since NSI isn't really needed for IPv6 - I don't want to rely on the NSI support being there, so if I ever want/need to add an SSL host to that domain, it's good to already have a unique IPv6 for it.

IPv4 users - well, they might get an SSL cert mis-match, as I do not wish to be greedy with IPv4 address.

Only potential issue I see is I may need to issue kernel directive to increase number of IPv6 addresses (I think default max is 16 on RHEL/CentOS 6, I'll have to check. Increasing it isn't hard though)

gaomizhe001

Quote from: DOMBlogger on September 15, 2011, 07:54:35 AM
Note on the Apache config - since IPv6 addresses are readily available, I'm doing virtual hosts a wee bit differently.
Example domain.net.conf in my /etc/httpd/conf.d directory:


NameVirtualHost [2600:3c00::xx:yyyy]:80

<VirtualHost nnn.nnn.nnn.nnn:80>
ServerName www.domain.tld
DocumentRoot "/srv/domains/domain.tld/www"
ErrorLog logs/www.domain.tld.error_log
CustomLog logs/www.domain.tld.access_log combined
</VirtualHost>

<VirtualHost [2600:3c00::xx:yyyy]:80>
ServerName www.domain.tld
DocumentRoot "/srv/domains/domain.tld/www"
ErrorLog logs/www.domain.tld.error_log
CustomLog logs/www.domain.tld.access_log combined
</VirtualHost>

<VirtualHost nnn.nnn.nnn.nnn:80>
ServerName domain.tld
RewriteEngine On
RewriteRule ^(.*)$ http://www.domain.tld$1 [R]
</VirtualHost>

<VirtualHost [2600:3c00::xx:yyyy]:80>
ServerName domain.tld
RewriteEngine On
RewriteRule ^(.*)$ http://www.domain.tld$1 [R]
</VirtualHost>

<Directory "/srv/domains/domain.tld/www">
  Options FollowSymLinks
  AllowOverride All
</Directory>

<Directory "/srv/domains/domain.tld/www/junk">
  Options FollowSymLinks Indexes
  AllowOverride All
</Directory>


I probably could (and should) combine the top two into 1 and bottom two into 1.

IPv4 address is used for several domains.
IPv6 is used only for the specific domain.tld and www.domain.tld - which is why the domain specific conf file is where the NameVirtualHost for the IPv6 goes (and is actually only needed for the mod_rewrite when the non www domain is requested)

Using a unique IP for each domain.tld in IPv6 lets me use that same unique IPv6 for each domain on port 443.

I know most if not every browser that supports IPv6 also supports NSI but since NSI isn't really needed for IPv6 - I don't want to rely on the NSI support being there, so if I ever want/need to add an SSL host to that domain, it's good to already have a unique IPv6 for it.

IPv4 users - well, they might get an SSL cert mis-match, as I do not wish to be greedy with IPv4 address.

Only potential issue I see is I may need to issue kernel directive to increase number of IPv6 addresses (I think default max is 16 on RHEL/CentOS 6, I'll have to check. Increasing it isn't hard though)