Linux operation and maintenance of automated tools Cobbler

About operating system installation automation, the earlier we use RedHat launched Kickstart to batch install the operating system, in recent years, RedHat has introduced a Cobbler.

Cobbler development using Python, compact and lightweight, able to complete the installation of the system, and even manage some services. (Known as a tool cobbler can learn)

Cobbler supports command line management, web interface management, but also provides an API interface to open the second method.

## Close SELinux, iptables! ! !

A supporting environment installation

yum -y install epel-release

yum -y install cobbler httpd rsync tftp-server xinetd dhcp pykickstart fence-agents

vim /etc/xinetd.d/tftp

service tftp
{
socket_type = dgram
protocol = udp
wait = yes
user = root
server = /usr/sbin/in.tftpd
server_args = -s /var/lib/tftpboot
disable = no
per_source = 11
cps = 100 2
flags = IPv4
}

vim /etc/xinetd.d/rsync

service rsync
{
disable = no
flags = IPv6
socket_type = stream
wait = no
user = root
server = /usr/bin/rsync
server_args = –daemon
log_on_failure += USERID
}

vim /etc/httpd/conf

ServerName 127.0.0.1:80

openssl passwd -1 -salt ‘random-phrase-here’ ‘test123’
$1$random-p$mzxQ/Sx848sXgvfwJCoZM0

vim /etc/cobbler/settings

manage_dhcp: 1

manage_tftpd: 1

manage_rsync: 1

next_server: 192.168.1.10

server: 192.168.1.10

default_password_crypted: “$1$random-p$mzxQ/Sx848sXgvfwJCoZM0″

vim /etc/cobbler/dhcp.template

subnet 192.168.1.0 netmask 255.255.255.0 {
option routers 192.168.1.2;
option subnet-mask 255.255.255.0;
range dynamic-bootp 192.168.1.100 192.168.1.120;
default-lease-time 21600;
max-lease-time 43200;
next-server $next_server;

chkconfig –add httpd
chkconfig –add xinetd
chkconfig –add dhcpd
chkconfig –add cobblerd
service httpd start
service xinetd start
service dhcpd start
service cobblerd start

cobbler check

The following are potential configuration items that you may want to fix:

1 : service dhcpd is not running
2 : debmirror package is not installed, it will be required to manage debian deployments and repositories

Restart cobblerd and then run ‘cobbler sync’ to apply changes.

cobbler sync
task started: 2015-05-27_010456_sync
task started (id=Sync, time=Wed May 27 01:04:56 2015)
running pre-sync triggers
cleaning trees
mkdir: /var/lib/tftpboot/pxelinux.cfg
mkdir: /var/lib/tftpboot/grub
mkdir: /var/lib/tftpboot/s390x
mkdir: /var/lib/tftpboot/ppc
mkdir: /var/lib/tftpboot/etc
removing: /var/lib/tftpboot/grub/images
copying bootloaders
trying hardlink /var/lib/cobbler/loaders/pxelinux.0 -> /var/lib/tftpboot/pxelinux.0
trying hardlink /var/lib/cobbler/loaders/menu.c32 -> /var/lib/tftpboot/menu.c32
trying hardlink /var/lib/cobbler/loaders/yaboot -> /var/lib/tftpboot/yaboot
trying hardlink /var/lib/cobbler/loaders/grub-x86.efi -> /var/lib/tftpboot/grub/grub-x86.efi
trying hardlink /var/lib/cobbler/loaders/grub-x86_64.efi -> /var/lib/tftpboot/grub/grub-x86_64.efi
copying distros to tftpboot
copying images
generating PXE configuration files
generating PXE menu structure
rendering DHCP files
generating /etc/dhcp/dhcpd.conf
rendering TFTPD files
generating /etc/xinetd.d/tftp
cleaning link caches
rendering Rsync files
running post-sync triggers
running python triggers from /var/lib/cobbler/triggers/sync/post/*
running python trigger cobbler.modules.sync_post_restart_services
running: dhcpd -t -q
received on stdout:
received on stderr:
running: service dhcpd restart
received on stdout: dhcpd?

received on stderr:
running shell triggers from /var/lib/cobbler/triggers/sync/post/*
running python triggers from /var/lib/cobbler/triggers/change/*
running python trigger cobbler.modules.scm_track
running shell triggers from /var/lib/cobbler/triggers/change/*
*** TASK COMPLETE ***

service xinetd restart
service cobblerd restart

mount /dev/cdrom /mnt/
cobbler import –path=/mnt/ –arch=x86_64 –name=CentOS-6.6-minimal

cobbler list
distros:
Centos-6.6-minimal-x86_64

profiles:
Centos-6.6-minimal-x86_64

systems:

repos:

images:

mgmtclasses:

packages:

files:

ks

shell > vim /var/lib/cobbler/kickstarts/Centos-6.6_minimal-x86_64.ks

# platform=x86, AMD64, Intel EM64T
# version=DEVEL
# Firewall configuration
firewall –disabled
# Install OS instead of upgrade
install
# Use network installation
url –url=”http://192.168.214.10/cobbler/ks_mirror/Centos-6.6-minimal-x84_64/”
# Root password
rootpw –iscrypted $1$hk0MvN4A$Dz.sYvyDjac1.cMVTk9270
# System authorization information
auth –useshadow –passalgo=sha512
# Use text mode install
text
# System keyboard
keyboard us
# System language
lang eng_US
# SELinux configuration
selinux –disabled
# Do not configure the X Window System
skipx
# Installation logging level
logging –level=info
# Reboot after installation
reboot
# System timezone
timezone –isUtc Asia/Singapore
# Network information
network –bootproto=dhcp –device=eth0 –onboot=on
# System bootloader configuration
bootloader –location=mbr
# Clear the Master Boot Record
zerombr
# Partition clearing information
clearpart –all –initlabel
# Disk partitioning information
part /boot –fstype=”ext4″ –size=200
part swap –fstype=”swap” –size=1024
part / –fstype=”ext4″ –grow –size=1

system-config-kickstart ks

ks

shell > cobbler distro list
Centos-6.6-minimal-x86_64

shell > cobbler profile report –name Centos-6.6-minimal-x86_64
Name : Centos-6.6-minimal-x86_64
TFTP Boot Files : {}
Comment :
DHCP Tag : default
Distribution : Centos-6.6-minimal-x86_64
Enable gPXE? : 0
Enable PXE Menu? : 1
Fetchable Files : {}
Kernel Options : {}
Kernel Options (Post Install) : {}
Kickstart : /var/lib/cobbler/kickstarts/sample_end.ks
Kickstart Metadata : {}
Management Classes : []
Management Parameters : <>
Name Servers : []
Name Servers Search Path : []
Owners : [‘admin’]
Parent Profile :
Proxy :
Red Hat Management Key : <>
Red Hat Management Server : <>
Repos : []
Server Override : <>
Template Files : {}
Virt Auto Boot : 1
Virt Bridge : xenbr0
Virt CPUs : 1
Virt Disk Driver Type : raw
Virt File Size(GB) : 5
Virt Path :
Virt RAM (MB) : 512
Virt Type : kvm

/var/lib/cobbler/kickstarts/sample_end.ks

shell > cobbler profile add –name=Centos-6.6-minimal –distro=Centos-6.6-minimal-x86_64 –kickstart=/var/lib/cobbler/kickstarts/Centos-6.6_minimal-x86_64.ks

shell > cobbler profile report –name Centos-6.6-minimal
Name : Centos-6.6-minimal
TFTP Boot Files : {}
Comment :
DHCP Tag : default
Distribution : Centos-6.6-minimal-x86_64
Enable gPXE? : 0
Enable PXE Menu? : 1
Fetchable Files : {}
Kernel Options : {}
Kernel Options (Post Install) : {}
Kickstart : /var/lib/cobbler/kickstarts/Centos-6.6_minimal-x86_64.ks
Kickstart Metadata : {}
Management Classes : []
Management Parameters : <>
Name Servers : []
Name Servers Search Path : []
Owners : [‘admin’]
Parent Profile :
Proxy :
Red Hat Management Key : <>
Red Hat Management Server : <>
Repos : []
Server Override : <>
Template Files : {}
Virt Auto Boot : 1
Virt Bridge : xenbr0
Virt CPUs : 1
Virt Disk Driver Type : raw
Virt File Size(GB) : 5
Virt Path :
Virt RAM (MB) : 512
Virt Type : xenpv

shell > cobbler –help
usage
=====
cobbler …
[add|edit|copy|getks*|list|remove|rename|report] [options|–help]
cobbler [options|–help]

shell > cobbler profile –help
usage
=====
cobbler profile add
cobbler profile copy
cobbler profile dumpvars
cobbler profile edit
cobbler profile find
cobbler profile getks
cobbler profile list
cobbler profile remove
cobbler profile rename
cobbler profile report

shell > cobbler sync

How to install Redis on a Centos 6.5 & Centos 7.0 Server

Redis is an open source, BSD licensed, advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.

How To Install Redis on Centos 7
# wget -r –no-parent -A ‘epel-release-*.rpm’ http://dl.fedoraproject.org/pub/epel/7/x86_64/e/
# rpm -Uvh dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-*.rpm

It will create two epel’s repo file inside /etc/yum.repos.d
These are –
1. epel.repo
2.epel-testing.repo
Install Redis with Yum
# yum install redis php-pecl-redis

Enable Redis service to start on boot
# systemctl enable redis-server.service

Disable Redis service from start on boot
# systemctl disable redis-server.service

Start/Stop/Restart Redis
# systemctl start redis-server.service
# systemctl stop redis-server.service
# systemctl restart redis-server.service

Check if Redis is Running
#systemctl is-active redis-server.service

How To Install Redis on Centos 6.5
# wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
# wget http://rpms.famillecollet.com/enterprise/remi-release-6.rpm
# rpm -Uvh remi-release-6*.rpm epel-release-6*.rpm
# yum install redis php-pecl-redis
# service redis start
# chkconfig redis on

Now verify its set to start at boot
# chkconfig –list redis
redis 0:off 1:off 2:on 3:on 4:on 5:on 6:off

Install EPEL repo

First we will install the EPEL repo. For more detail on EPEL repo, we suggest you to read our this post.

Because our system has x86_64 Operating System architecture, we will use only epel repo package for x86_64 . Search epel repo package as per your Operating System architecture(EPEL URL)

wget -r –no-parent -A ‘epel-release-*.rpm’ http://dl.fedoraproject.org/pub/epel/7/x86_64/e/

rpm -Uvh dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-*.rpm
It will create two epel’s repo file inside /etc/yum.repos.d
These are –
1. epel.repo
2.epel-testing.repo

[root@localhost ~]# ls -l /etc/yum.repos.d/
total 28
-rw-r–r–. 1 root root 1612 Jul 4 07:00 CentOS-Base.repo
-rw-r–r–. 1 root root 640 Jul 4 07:00 CentOS-Debuginfo.repo
-rw-r–r–. 1 root root 1331 Jul 4 07:00 CentOS-Sources.repo
-rw-r–r–. 1 root root 156 Jul 4 07:00 CentOS-Vault.repo
-rw-r–r–. 1 root root 957 Sep 2 12:14 epel.repo
-rw-r–r–. 1 root root 1056 Sep 2 12:14 epel-testing.repo
[root@localhost ~]#
Install redis server

Now use yum command to install redis server

yum install redis
Two important redis server configuration file’s path
1. /etc/redis.conf
2. /etc/redis-sentinel.conf

Now start the redis server after this.

systemctl start redis.service
Check the running status of redis server

systemctl status redis.service
To test the installation of Redis, use below given command

redis-cli ping
If the response output is PONG, it means installation is completed successfully.

[root@localhost ~]# redis-cli ping
PONG
[root@localhost ~]#
Start/Stop/Restart/Status and Enable redis server

To start redis server

systemctl start redis.service
To stop redis server

systemctl stop redis.service
To restart redis server

systemctl restart redis.service
To get running status of redis server

systemctl status redis.service
To enable redis server at system’s booting time.

systemctl enable redis.service
To disable redis server at system’s booting time.

systemctl disable redis.service
Listening Port Of Redis Server

Redis Server listens by default at port number 6379. Use below given ss command. (To learn more about ss command)

[root@localhost ~]# ss -nlp|grep redis
tcp LISTEN 0 128 127.0.0.1:6379 *:* users:((“redis-server”,19706,4))
[root@localhost ~]#
Note: On minimal installed CentOS 7/ RHEL 7,you wont get netstat command. Instead of netstat command, use ss command which is by default available on system.

[root@localhost ~]# redis-cli
127.0.0.1:6379>
127.0.0.1:6379>
127.0.0.1:6379> exit
[root@localhost ~]#
To check help of redis-cli command.

redis-cli –help

What is sysctl?

sysctl is an interface to view and dynamically change parameters in Linux and other *NIX operating systems. In Linux, most of the dynamic Kernel settings can be changed via sysctl. The parameters set by sysctl are also available under the virtual /proc filesystem.

How do I use sysctl?

To read values you’ve two options:

reading parametersShell

# Option 1: Using the sysctl command to read current parameters:
sysctl net.ipv4.ip_forward # display specific parameter
sysctl net.ipv4 # display all net.ipv4.* parameters
sysctl -a # display all parameters

# Option 2: Using the /proc filesystem:
cat /proc/sys/net/ipv4/ip_forward

# Option 1: Using the sysctl command to read current parameters:
sysctl net.ipv4.ip_forward # display specific parameter
sysctl net.ipv4 # display all net.ipv4.* parameters
sysctl -a # display all parameters

# Option 2: Using the /proc filesystem:
cat /proc/sys/net/ipv4/ip_forward
To write values you can use both options again:

changing parametersShell

# Option 1: Using the sysctl command to change a parameter:
sysctl net.ipv4.ip_forward=1

# Option 2: Using the /proc filesystem to change a parameter:
echo 1 >/proc/sys/net/ipv4/ip_forward
1
2
3
4
5
# Option 1: Using the sysctl command to change a parameter:
sysctl net.ipv4.ip_forward=1

# Option 2: Using the /proc filesystem to change a parameter:
echo 1 >/proc/sys/net/ipv4/ip_forward
However, these parameters are not persistent. You’ve to configure them in /etc/sysctl.conf or /etc/sysctl.d/* if you want them active after a reboot.

sysctl configuration files

/etc/sysctl.conf
/etc/sysctl.d/
1
2
/etc/sysctl.conf
/etc/sysctl.d/
Please note that configuration changes will not be detected automatically. You’ve to trigger the reload manually:

reload sysctl configuration fileShell

sysctl -p [filename]
1
sysctl -p [filename]
Tuning Linux with sysctl

Kernel

To automatically reboot a system after a kernel panic, you can set the following parameter to the amount of seconds to wait before reboot:

reboot system after kernel panicShell

kernel.panic = 60

kernel.panic = 60
Linux Kernels provide a magic SysRq key, which allows the user to perform low-level commands regardless of the systems state. To enable this magic key you’ve to set:

enable magic SysRq keyShell

kernel.sysrq = 1

kernel.sysrq = 1
To make sure core dumps will always be written set the following parameter:

write core dumpsShell

fs.suid_dumpable = 2

fs.suid_dumpable = 2
It can be useful to have the PID appended on the filename of core dumps. This can be especially useful for debugging multi-threaded applications and it’s easy to setup:

add PID to core dumpsShell

kernel.core_uses_pid = 1

kernel.core_uses_pid = 1
To increase the maximum number of used process IDs you can define the following parameter:

increase maximum PIDShell

kernel.pid_max = 65536

kernel.pid_max = 65536
Memory

To tune the memory (VM) behaviour in Linux, you can set some vm.* parameters.

For example to tell the Kernel how aggressively memory pages should be written to disk (aka swapping), you’ve to change the swappiness value. The higher the value, the more aggressive the swapping:

swappinessShell

vm.swappiness
1
vm.swappiness
When you look at filesystems then most of the time some kind of cache is involved. The amount of filesystem cache is based on the percentage of total available memory. To set the maximum amount of filesystem cache can be defined with:

maximum filesystem cacheShell

vm.dirty_ratio = 40

vm.dirty_ratio = 40
When the defined percentage of memory is reached, then all I/O writes are blocked until enough dirty pages have been flushed to disk by pdflush. This is quite suboptimal because on a healthy system you don’t want to have blocked I/O writes at all. Therefor there’s another parameter, which defines the minimal percentage of dirty memory before the background pdflush process starts to flush out dirty memory pages:

background filesystem cache flushesShell

vm.dirty_background_ratio = 10

vm.dirty_background_ratio = 10
As already described before, pdflush is in charge of flushing dirty pages to disk. So you can optionally change the flush interval by setting the following parameter (in hundredths of seconds, e.g. 500 = 5s):

pdflush intervalShell

vm.dirty_writeback_centisecs = 500

vm.dirty_writeback_centisecs = 500
Of course pdflush needs to know when data can be removed from cache. Sometimes it makes sense to increase the time how long “untouched” data lives be in the cache before it’s marked as expired. Just overwrite the following parameter (again in hundredths of seconds):

pdflush intervalShell

vm.dirty_expire_centiseconds = 3000

vm.dirty_expire_centiseconds = 3000
If you want to have more informations about the memory on your system, just have a look at:

display memory informationsShell

cat /proc/meminfo

cat /proc/meminfo
Filesystem

To increase the maximum amount of file descriptors you can use.

increase maximum filedescriptorsShell

fs.file-max = 65535

fs.file-max = 65535
Exec Shield

Exec Shield is a protection against worms and other automated remote attacks on Linux systems. It was invented by Red Hat in 2002. To enable Exec Shield:

enable Exec Shield protectionShell

kernel.exec-shield = 1
kernel.randomize_va_space = 1

kernel.exec-shield = 1
kernel.randomize_va_space = 1
Network Core

Some applications are configured for performance and sometimes an application can handle huge buffers. To increase the maximum buffer size for all sockets / connections (this will affect all buffers, e.g. net.ipv4.tcp_rmem) you can use:

increase max buffer sizeShell

net.core.rmem_max = 8388608
net.core.wmem_max = 8388608

net.core.rmem_max = 8388608
net.core.wmem_max = 8388608
When a system is under heavy load and an interface receives a lot of packets, then the Kernel might not process them fast enough. You can increase the number of packets hold in the queue (backlog) by changing:

increase maximum backlog size for net devicesShell

net.core.netdev_max_backlog = 5000

net.core.netdev_max_backlog = 5000
IPv4

First of all we recommend you tune ICMP a bit. You can do that by ignoring ICMP broadcasts, which will protect you from ICMP floods. We also ignore bogus responses to broadcast frames (violation against RFC1122), so that our log isn’t full of Kernel warnings:

hardening ICMPShell

net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
SYN floods are a type of DDoS and can harm your system. To protect from it you should enable SYN cookies, resize the SYN backlog (queue size) and reduce SYN/ACK retries:

enable SYN cookiesShell

# Turn on SYN cookies to protect from SYN flood attacks.
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 3

# Turn on SYN cookies to protect from SYN flood attacks.
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 3
To log packets with impossible addresses simply enable:

log impossible IPv4 addressesShell

net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
To disable IP source routing (SRR), so that nobody can tell us which path a packet should take:

deny packets with SRR optionShell

net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
By default, routers router everything and even packages which don’t belong to their network(s). To avoid that we’ve to make sure strict reverse path filtering is enabled as defined in RFC3704:

enable strict reverse path filteringShell

net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
Some applications support higher read and write buffers for sockets. The buffer size parameters are defined by 3 values (min, default, max). To increase the maximum buffer set:

increase max TCP buffer sizeShell

net.ipv4.tcp_rmem = 4096 87380 8388608
net.ipv4.tcp_wmem = 4096 87380 8388608

net.ipv4.tcp_rmem = 4096 87380 8388608
net.ipv4.tcp_wmem = 4096 87380 8388608
To get better throughput in a network, it might make sense to enable TCP window scaling as defined in RFC1323:

enable TCP window scalingShell

net.ipv4.tcp_window_scaling = 1

net.ipv4.tcp_window_scaling = 1
Disable (ICMP) redirects at all. Please note that the send_redirects parameters should be enabled on routers:

disable redirectsShell

net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.all.send_redirects = 0 # Don’t disable this on routers!
net.ipv4.conf.default.send_redirects = 0 # Don’t disable this on routers!

net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.all.send_redirects = 0 # Don’t disable this on routers!
net.ipv4.conf.default.send_redirects = 0 # Don’t disable this on routers!
Finally disable IPv4 forwarding on non-routing systems:

disable forwardingShell

net.ipv4.ip_forward = 0

net.ipv4.ip_forward = 0
IPv6

Those who don’t use IPv6 at all should disable it:

disable IPv6Shell

net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.all.disable_ipv6 = 1
If you’re already using IPv6 you might be interested in the following parameters.

On non-routing systems you should disable router solicitations:

disable router solicitationsShell

net.ipv6.conf.default.router_solicitations = 0
net.ipv6.conf.all.router_solicitations = 0

net.ipv6.conf.default.router_solicitations = 0
net.ipv6.conf.all.router_solicitations = 0
You should also don’t accept routing preferences from router advertisements:

disable router preferences in RAShell

net.ipv6.conf.default.accept_ra_rtr_pref = 0
net.ipv6.conf.all.accept_ra_rtr_pref = 0

net.ipv6.conf.default.accept_ra_rtr_pref = 0
net.ipv6.conf.all.accept_ra_rtr_pref = 0
Don’t try to learn prefix information in router advertisements:

don’t learn prefix informations in RAShell

net.ipv6.conf.default.accept_ra_pinfo = 0
net.ipv6.conf.all.accept_ra_pinfo = 0

net.ipv6.conf.default.accept_ra_pinfo = 0
net.ipv6.conf.all.accept_ra_pinfo = 0
Don’t accept hop limits from router advertisements:

don’t accept hop limits from RAShell

net.ipv6.conf.default.accept_ra_defrtr = 0
net.ipv6.conf.all.accept_ra_defrtr = 0

net.ipv6.conf.default.accept_ra_defrtr = 0
net.ipv6.conf.all.accept_ra_defrtr = 0
Disable IPv6 auto configuration, so that no unicast addresses can automatically be configured on your interface from a router advertisement:

disable auto configuration from RAShell

net.ipv6.conf.default.autoconf = 0
net.ipv6.conf.all.autoconf = 0

net.ipv6.conf.default.autoconf = 0
net.ipv6.conf.all.autoconf = 0
If you don’t want your system to be verbose about its neighbours, you should disable neighbour solicitations at all:

disable auto configuration from RAShell

net.ipv6.conf.default.dad_transmits = 0
net.ipv6.conf.all.dad_transmits = 0

net.ipv6.conf.default.dad_transmits = 0
net.ipv6.conf.all.dad_transmits = 0
Unless you need more than one global unicast address, you should fix the number of assigned global unicast addresses per interface to 1:

disable auto configuration from RAShell

net.ipv6.conf.default.max_addresses = 1
net.ipv6.conf.all.max_addresses = 1

net.ipv6.conf.default.max_addresses = 1
net.ipv6.conf.all.max_addresses = 1
.all & .default

A lot of sysctl parameters have several values, because there’s a .default, .all and sometimes even a . value. While the . value is obvious, you’ve to look closer on the other two.

According to a comment on the linux-kernel mailing list, there’s one major difference:

The default value will only be applied ONCE, at the point when an interface is created.
The all value will ALWAYS applied in addition.
This means when an interface is created, the default value will be applied to it once. However, you can overwrite that with the interface-specific parameter. The global .all parameter will always be applied in addition and in the end it depends of the logical operator how the “final value” looks like.

For example there are parameters where all settings need to be 1 (aka AND), where only one of the settings need to be 1 (aka OR) or where the highest value will be used (aka MAX).

So it’s important to know that existing interfaces might have a different value than the one you’ve set as default or all.