3
# cat /etc/redhat-release 
Fedora release 26 (Twenty Six)
# ip token set ::DEAD:BABE:BEEF:CAFE/64 dev devName
# vi /etc/sysconfig/network-scripts/ifcfg-devName
IPV6_PRIVACY=yes
[or]
IPV6_PRIVACY=rfc4941
# vi /etc/sysctl.d/99-sysctl.conf
net.ipv6.conf.all.use_tempaddr=2
net.ipv6.conf.default.use_tempaddr=2
# vi /etc/NetworkManager/NetworkManager.conf
[connection]
ipv6.ip6-privacy=2
# ip address flush dev devName
# reboot

a random ipv6 address is generated but so is the EUI-64 global and link local address based on my government Mandated Anonymity Cracking address (a.k.a. MAC address)

if I change the MAC address in the config file to something random

# vi /etc/sysconfig/network-scripts/ifcfg-devName
HWADDR=00:12:34:56:78:9A

It still generates a random ipv6 address but the other ipv6 address is static and never changes but at least it isn't based on any MAC address (including the one specified above).

How do I enable rfc4941 random temporary addresses while disabling EUI-64 addresses? New addresses are supposed to be generated at least once a day and on reboot... what setting am I missing?

  • settings found in 99-sysctl.conf as shown above are now (as of F29) found in /etc/sysctl.d/10-ipv6-privacy.conf but have the same default values (2). – antiplex Jan 1 '19 at 13:40
-1

https://fedoraproject.org/wiki/Networking/Addressing is fedora specific dyanamic IPv6 setup. Is this the documentation you tried and which is not working? They have some legacy documentation which probably does not work anymore. Since there are so many networking variables, it's largely pointless to suggest a specific solution without knowing the specific circumstances.

https://superuser.com/questions/638024/use-ipv6-temporary-address-only-with-remote-peers is I believe the issue you want handled. Temporary auto change IPv6 addresses were the solution, not an ideal one of course, to the original design flaw of IPv6 exposing your system IP to the internet [one that will be exploited for decades to come by botnets running on poorly designed and configured internet of things IoT devices], since the original idea was to not use firewalls/routers with internal LAN IP ranges, which were translated to the external world by the router, but to have each and every device directly connect to the internet. What could possibly go wrong in that idea, lol?

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.