IPv6 is not working still if its enabled

[artem-sidorenko]

The default listen value blocks listening of sshd on IPv6 interfaces:

default['ssh']['listen_to']               = ['0.0.0.0']     # sshd

This default should react on the IPv6 setting and allow listening on IPv6 too

[chris-rock]

Thanks @artem-sidorenko that is a great idea

[artem-sidorenko]

Question to the handling of such defaults, which depend on another attribute with a default value.

In chef-os-hardening a problem like this is solved like:

default['network']['ipv6']['enable'] = false

default['ssh']['listen_to'] = if node['network']['ipv6']['enable']
  ['0.0.0.0', '::']
else
  ['0.0.0.0']
end

The attribute files are loaded by chef in the run list order prior to the compilation of recipes. So basically in this implementation we do have only one way to change the ['network']['ipv6']['enable'] to true and ['ssh']['listen_to'] gets the value ['0.0.0.0', '::']:

1. if we do default['network']['ipv6']['enable']=true in the run list before this cookbook - this value gets overwritten
2. if we do default['network']['ipv6']['enable']=true in the run list after this cookbook - default['ssh']['listen_to'] is already set to ['0.0.0.0'] and won't be changed
3. if we do override['network']['ipv6']['enable']=true in the run list before this cookbook - it works as desired, default['ssh']['listen_to']=true
4. if we do override['network']['ipv6']['enable']=true in the run list after this cookbook - default['ssh']['listen_to'] is already set to ['0.0.0.0'] and won't be changed

In the end, its possible to change the defaults of attributes depending on other attributes only in the 3rd case: via override['network']['ipv6']['enable']=true in the run list before this cookbook. In my eyes its a bit limited and we should consider some other implementation ways.

I see following option - we move attributes like default['ssh']['listen_to'] to the recipe files:

• ['network']['ipv6']['enable'] would be properly evaluated within default/override precedence levels
• default['ssh']['listen_to'] is set in the recipe in the compile phase based on node['network']['ipv6']['enable']
• if there is a need to override ['ssh']['listen_to'], it should be done via override['ssh']['listen_to'] (and we document it this way)

@chris-rock @arlimus @atomic111 opinions?