I have a Stretch-based desktop with IPv6 disabled, both as parameter in the kernel.
I have the ssh client from the openssh-client
package, version 1:7.6p1-2.0nosystemd1, installed.
Upon debugging a DNS resolving problem, I did notice nonetheless the ssh client is doing IPv6 DNS related queries as the included tcpdump
logs show.
My question, is, how to disable that behaviour?
PS. I am not asking whether it is a good or bad idea, just asking how to do it in a system that has already all IPv6 services disabled.
tcpdump
logs when doing the commands ssh server1 ; ssh server2
.
# tcpdump -n port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes
02:53:37.479073 IP 192.168.1.5.58296 > 192.168.1.1.53: 61011+ A? server1.home. (30)
02:53:37.479100 IP 192.168.1.5.58296 > 192.168.1.1.53: 4719+ AAAA? server1.home. (30)
02:53:37.487504 IP 192.168.1.1.53 > 192.168.1.5.58296: 61011 NXDomain* 0/1/0 (69)
02:53:37.493279 IP 192.168.1.1.53 > 192.168.1.5.58296: 4719 NXDomain* 0/1/0 (69)
02:53:37.493428 IP 192.168.1.5.60276 > 192.168.1.1.53: 31390+ A? server1. (25)
02:53:37.493455 IP 192.168.1.5.60276 > 192.168.1.1.53: 50392+ AAAA? server1. (25)
02:53:37.527879 IP 192.168.1.1.53 > 192.168.1.5.60276: 31390 NXDomain 0/1/0 (100)
02:53:37.535417 IP 192.168.1.1.53 > 192.168.1.5.60276: 50392 NXDomain 0/1/0 (100)
02:53:38.447390 IP 192.168.1.5.36155 > 192.168.1.1.53: 39363+ A? server1.home. (30)
02:53:38.447412 IP 192.168.1.5.36155 > 192.168.1.1.53: 4430+ AAAA? server1.home. (30)
02:53:38.455743 IP 192.168.1.1.53 > 192.168.1.5.36155: 39363 NXDomain* 0/1/0 (69)
02:53:38.461492 IP 192.168.1.1.53 > 192.168.1.5.36155: 4430 NXDomain* 0/1/0 (69)
02:53:38.461606 IP 192.168.1.5.39311 > 192.168.1.1.53: 45400+ A? server1. (25)
02:53:38.461631 IP 192.168.1.5.39311 > 192.168.1.1.53: 872+ AAAA? server1. (25)
02:53:38.493714 IP 192.168.1.1.53 > 192.168.1.5.39311: 45400 NXDomain 0/1/0 (100)
02:53:38.500353 IP 192.168.1.1.53 > 192.168.1.5.39311: 872 NXDomain 0/1/0 (100)
Proof IPv6 is disabled in kernel/grub:
$ cat /proc/cmdline
BOOT_IMAGE=/boot/vmlinuz-4.10.5-antix.3-amd64-smp root=UUID=00c17984-859f-4197-8bd8-b346ddd092bd ro iommu=1 intel_iommu=on iommu=pt ip6.disable=1 intremap=no_x2apic_optout radeon.pcie_gen2=0
And also in sysctl
:
$ cat /etc/sysctl.conf | grep ipv6
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
Also /etc/gai.conf
is changed to prioritize IPv4.
getaddrinfo
is configured by the content of/etc/gai.conf
where you can define the "priority" of IP addresses between each other. And so you can make sure that IPv4 address are returned before IPv6 ones if you need this behavior, but then it depends of course on what the application does (if it does not stop at the first IP address returned).