1

I have a Stretch-based desktop with IPv6 disabled, both as parameter in the kernel.

I have the ssh client from the openssh-client package, version 1:7.6p1-2.0nosystemd1, installed.

Upon debugging a DNS resolving problem, I did notice nonetheless the ssh client is doing IPv6 DNS related queries as the included tcpdump logs show.

My question, is, how to disable that behaviour?

PS. I am not asking whether it is a good or bad idea, just asking how to do it in a system that has already all IPv6 services disabled.

tcpdump logs when doing the commands ssh server1 ; ssh server2.

# tcpdump -n port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes
02:53:37.479073 IP 192.168.1.5.58296 > 192.168.1.1.53: 61011+ A? server1.home. (30)
02:53:37.479100 IP 192.168.1.5.58296 > 192.168.1.1.53: 4719+ AAAA? server1.home. (30)
02:53:37.487504 IP 192.168.1.1.53 > 192.168.1.5.58296: 61011 NXDomain* 0/1/0 (69)
02:53:37.493279 IP 192.168.1.1.53 > 192.168.1.5.58296: 4719 NXDomain* 0/1/0 (69)
02:53:37.493428 IP 192.168.1.5.60276 > 192.168.1.1.53: 31390+ A? server1. (25)
02:53:37.493455 IP 192.168.1.5.60276 > 192.168.1.1.53: 50392+ AAAA? server1. (25)
02:53:37.527879 IP 192.168.1.1.53 > 192.168.1.5.60276: 31390 NXDomain 0/1/0 (100)
02:53:37.535417 IP 192.168.1.1.53 > 192.168.1.5.60276: 50392 NXDomain 0/1/0 (100)
02:53:38.447390 IP 192.168.1.5.36155 > 192.168.1.1.53: 39363+ A? server1.home. (30)
02:53:38.447412 IP 192.168.1.5.36155 > 192.168.1.1.53: 4430+ AAAA? server1.home. (30)
02:53:38.455743 IP 192.168.1.1.53 > 192.168.1.5.36155: 39363 NXDomain* 0/1/0 (69)
02:53:38.461492 IP 192.168.1.1.53 > 192.168.1.5.36155: 4430 NXDomain* 0/1/0 (69)
02:53:38.461606 IP 192.168.1.5.39311 > 192.168.1.1.53: 45400+ A? server1. (25)
02:53:38.461631 IP 192.168.1.5.39311 > 192.168.1.1.53: 872+ AAAA? server1. (25)
02:53:38.493714 IP 192.168.1.1.53 > 192.168.1.5.39311: 45400 NXDomain 0/1/0 (100)
02:53:38.500353 IP 192.168.1.1.53 > 192.168.1.5.39311: 872 NXDomain 0/1/0 (100)

Proof IPv6 is disabled in kernel/grub:

$ cat /proc/cmdline 
BOOT_IMAGE=/boot/vmlinuz-4.10.5-antix.3-amd64-smp root=UUID=00c17984-859f-4197-8bd8-b346ddd092bd ro iommu=1 intel_iommu=on iommu=pt ip6.disable=1 intremap=no_x2apic_optout radeon.pcie_gen2=0

And also in sysctl:

$ cat /etc/sysctl.conf | grep ipv6
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1

Also /etc/gai.conf is changed to prioritize IPv4.

Improve this question
6
  • 1
    Red Hat explains that this happens because glibc is RFC2553 compliant, (now RFC3493) that there is no supported way to disable this behavior in glibc, and that the glibc maintainers aren't going to add one. Instead each application has to be reconfigured to use only IPv4 if this noncompliant behavior is truly desired. --- Of course, this is all in addition to the usual warnings about disabling IPv6.
    – Michael Hampton
    Aug 2, 2018 at 12:33
  • This is sort of a jumpbox/desktop in a corporate IPv4-only environment, but yeah the usual warnings apply.
    – Rui F Ribeiro
    Aug 2, 2018 at 13:12
  • Ah, so the box itself is a workaround for the lack of IPv6 :)
    – Michael Hampton
    Aug 2, 2018 at 13:13
  • @MichaelHampton getaddrinfo is configured by the content of /etc/gai.conf where you can define the "priority" of IP addresses between each other. And so you can make sure that IPv4 address are returned before IPv6 ones if you need this behavior, but then it depends of course on what the application does (if it does not stop at the first IP address returned).
    – Patrick Mevzek
    Aug 4, 2018 at 18:25
  • 1
    @PatrickMevzek I know how gai.conf works. Changing it won't help here because the DNS AAAA lookups will still go out.
    – Michael Hampton
    Aug 4, 2018 at 19:09

1 Answer 1

Reset to default
5

To disable IPv6 name queries in your sshclient, you can:

  • call ssh in the command line with the -4 option to only operate and do queries in IPv4;

  • define then an alias as:

    alias ssh=`ssh -4`

If you have system administration of the machine, you can also disable the IPv6 functions/DNS queries in the ssh client system wide configuration file editing /etc/ssh/ssh_config and adding the following configuration parameter:

AddressFamily inet

From man ssh_config:

AddressFamily

Specifies which address family to use when connecting. Valid arguments are ''any'', ''inet'' (use IPv4 only), or ''inet6'' (use IPv6 only).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .