2

I am trying to get my CentOS v7 server to run IPv6. Root works, it can ping using "ping6 ipv6.google.com", and ifconfig looks great; I see the lines:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
inet 149.202.217.90  netmask 255.255.255.0  broadcast 149.202.217.255
inet6 fe80::ec4:7aff:fec4:d912  prefixlen 64  scopeid 0x20<link>
inet6 2001:41d0:1000:1c5a::  prefixlen 64  scopeid 0x0<global>

But as an unprivileged user, I can't ping ipv6 and I don't see the inet6 addresses in ifconfig.

What is happening? Why can't my users see the same interfaces, setup in the same way as root?

[edit]

As requested, ip a s and ping6 -c1 ipv6.google.com output:

root

[root@rabbit ~]# ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 2001:41d0:1000:1c5a::/64 scope global
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: bond0: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop state DOWN
    link/ether 5e:63:58:37:5d:30 brd ff:ff:ff:ff:ff:ff
3: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN
    link/ether 32:ad:47:94:1f:b1 brd ff:ff:ff:ff:ff:ff
4: ifb0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN qlen 32
    link/ether 7e:52:08:a5:1a:dd brd ff:ff:ff:ff:ff:ff
5: ifb1: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN qlen 32
    link/ether 3e:ba:b9:d1:09:3b brd ff:ff:ff:ff:ff:ff
6: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 0c:c4:7a:c4:d9:12 brd ff:ff:ff:ff:ff:ff
    inet 149.202.217.90/24 brd 149.202.217.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 2001:41d0:1000:1c5a::/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::ec4:7aff:fec4:d912/64 scope link
       valid_lft forever preferred_lft forever
7: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 0c:c4:7a:c4:d9:13 brd ff:ff:ff:ff:ff:ff
8: teql0: <NOARP> mtu 1500 qdisc noop state DOWN qlen 100
    link/void
9: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN
    link/ipip 0.0.0.0 brd 0.0.0.0
10: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN
    link/sit 0.0.0.0 brd 0.0.0.0
11: ip6tnl0@NONE: <NOARP> mtu 1452 qdisc noop state DOWN
    link/tunnel6 :: brd ::

[root@rabbit ~]# ping6 -c1 ipv6.google.com
PING ipv6.google.com(par03s15-in-x0e.1e100.net) 56 data bytes
64 bytes from par03s15-in-x0e.1e100.net: icmp_seq=1 ttl=57 time=6.61 ms

--- ipv6.google.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 6.615/6.615/6.615/0.000 ms

user (pryormic)

[pryormic@rabbit ~]$ ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 2001:41d0:1000:1c5a::/64 scope global
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: bond0: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop state DOWN
    link/ether 5e:63:58:37:5d:30 brd ff:ff:ff:ff:ff:ff
3: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN
    link/ether 32:ad:47:94:1f:b1 brd ff:ff:ff:ff:ff:ff
4: ifb0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN qlen 32
    link/ether 7e:52:08:a5:1a:dd brd ff:ff:ff:ff:ff:ff
5: ifb1: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN qlen 32
    link/ether 3e:ba:b9:d1:09:3b brd ff:ff:ff:ff:ff:ff
6: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 0c:c4:7a:c4:d9:12 brd ff:ff:ff:ff:ff:ff
    inet 149.202.217.90/24 brd 149.202.217.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 2001:41d0:1000:1c5a::/64 scope global
       valid_lft forever preferred_lft forever
    inet6 fe80::ec4:7aff:fec4:d912/64 scope link
       valid_lft forever preferred_lft forever
7: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 0c:c4:7a:c4:d9:13 brd ff:ff:ff:ff:ff:ff
8: teql0: <NOARP> mtu 1500 qdisc noop state DOWN qlen 100
    link/void
9: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN
    link/ipip 0.0.0.0 brd 0.0.0.0
10: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN
    link/sit 0.0.0.0 brd 0.0.0.0
11: ip6tnl0@NONE: <NOARP> mtu 1452 qdisc noop state DOWN
    link/tunnel6 :: brd ::

[pryormic@rabbit ~]$ ping6 -c1 ipv6.google.com
ping: icmp open socket: Operation not permitted

[edit2]

I've added ifconfig output below:

root

[root@rabbit ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 149.202.217.90  netmask 255.255.255.0  broadcast 149.202.217.255
        inet6 fe80::ec4:7aff:fec4:d912  prefixlen 64  scopeid 0x20<link>
        inet6 2001:41d0:1000:1c5a::  prefixlen 64  scopeid 0x0<global>
        ether 0c:c4:7a:c4:d9:12  txqueuelen 1000  (Ethernet)
        RX packets 12131475  bytes 2122218137 (1.9 GiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1113935  bytes 690582284 (658.5 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        ether 0c:c4:7a:c4:d9:13  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6632  bytes 1169904 (1.1 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        inet6 2001:41d0:1000:1c5a::  prefixlen 64  scopeid 0x0<global>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 332704  bytes 448694222 (427.9 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 332704  bytes 448694222 (427.9 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

user (pryormic)

[pryormic@rabbit ~]$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 149.202.217.90  netmask 255.255.255.0  broadcast 149.202.217.255
        ether 0c:c4:7a:c4:d9:12  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        ether 0c:c4:7a:c4:d9:13  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 0  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
5
  • What is the output of ip a s and ping6 -c1 ipv6.google.com as root and as an ordinary user? – Henrik supports the community Jun 4 '16 at 11:44
  • @Henrik I've amended the question with that output – watfordxp Jun 4 '16 at 11:52
  • 2
    What is the result of getcap /bin/ping6? – Thomas Jun 4 '16 at 13:18
  • No output from that command. Though FYI I can use ping successfully, just not ping6. I've added ifconfig output to the OP. – watfordxp Jun 4 '16 at 13:33
  • 1
    Is your ping6 setuid root? – Celada Jun 4 '16 at 13:51
2

The following command should give users the capability to use ping6. As root run

setcap cap_net_raw+ep /usr/bin/ping
3
  • Why not just chmod +s /usr/bin/ping? – user140866 Jun 4 '16 at 17:02
  • 2
    That would be possible, too. But then ping would run as root. With capabilities, you just give the command the rights it needs to work. Some kind of philosophy... – Thomas Jun 4 '16 at 19:33
  • That worked, thanks!! So why does do the inet6 entries not show in ifconfig unless under root? – watfordxp Jun 4 '16 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.